2 * Copyright (C) 2004 IBM Corporation
5 * Leendert van Doorn <leendert@watson.ibm.com>
6 * Dave Safford <safford@watson.ibm.com>
7 * Reiner Sailer <sailer@watson.ibm.com>
8 * Kylene Hall <kjhall@us.ibm.com>
10 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
12 * Device driver for TCG/TCPA TPM (trusted platform module).
13 * Specifications at www.trustedcomputinggroup.org
15 * This program is free software; you can redistribute it and/or
16 * modify it under the terms of the GNU General Public License as
17 * published by the Free Software Foundation, version 2 of the
20 * Note, the TPM chip is not interrupt driven (only polling)
21 * and can have very long timeouts (minutes!). Hence the unusual
26 #include <linux/poll.h>
27 #include <linux/slab.h>
28 #include <linux/mutex.h>
29 #include <linux/spinlock.h>
30 #include <linux/freezer.h>
33 #include "tpm_eventlog.h"
42 #define TPM_MAX_ORDINAL 243
43 #define TSC_MAX_ORDINAL 12
44 #define TPM_PROTECTED_COMMAND 0x00
45 #define TPM_CONNECTION_COMMAND 0x40
48 * Bug workaround - some TPM's don't flush the most
49 * recently changed pcr on suspend, so force the flush
50 * with an extend to the selected _unused_ non-volatile pcr.
52 static int tpm_suspend_pcr;
53 module_param_named(suspend_pcr, tpm_suspend_pcr, uint, 0644);
54 MODULE_PARM_DESC(suspend_pcr,
55 "PCR to use for dummy writes to faciltate flush on suspend.");
57 static LIST_HEAD(tpm_chip_list);
58 static DEFINE_SPINLOCK(driver_lock);
59 static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
62 * Array with one entry per ordinal defining the maximum amount
63 * of time the chip could take to return the result. The ordinal
64 * designation of short, medium or long is defined in a table in
65 * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
66 * values of the SHORT, MEDIUM, and LONG durations are retrieved
67 * from the chip during initialization with a call to tpm_get_timeouts.
69 static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
70 TPM_UNDEFINED, /* 0 */
75 TPM_UNDEFINED, /* 5 */
125 TPM_UNDEFINED, /* 55 */
145 TPM_UNDEFINED, /* 75 */
155 TPM_UNDEFINED, /* 85 */
165 TPM_UNDEFINED, /* 95 */
170 TPM_MEDIUM, /* 100 */
175 TPM_UNDEFINED, /* 105 */
205 TPM_UNDEFINED, /* 135 */
215 TPM_UNDEFINED, /* 145 */
225 TPM_UNDEFINED, /* 155 */
235 TPM_UNDEFINED, /* 165 */
245 TPM_UNDEFINED, /* 175 */
250 TPM_MEDIUM, /* 180 */
255 TPM_MEDIUM, /* 185 */
260 TPM_UNDEFINED, /* 190 */
265 TPM_UNDEFINED, /* 195 */
280 TPM_MEDIUM, /* 210 */
285 TPM_UNDEFINED, /* 215 */
295 TPM_UNDEFINED, /* 225 */
305 TPM_UNDEFINED, /* 235 */
315 static void user_reader_timeout(unsigned long ptr)
317 struct tpm_chip *chip = (struct tpm_chip *) ptr;
319 schedule_work(&chip->work);
322 static void timeout_work(struct work_struct *work)
324 struct tpm_chip *chip = container_of(work, struct tpm_chip, work);
326 mutex_lock(&chip->buffer_mutex);
327 atomic_set(&chip->data_pending, 0);
328 memset(chip->data_buffer, 0, TPM_BUFSIZE);
329 mutex_unlock(&chip->buffer_mutex);
333 * Returns max number of jiffies to wait
335 unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
338 int duration_idx = TPM_UNDEFINED;
340 u8 category = (ordinal >> 24) & 0xFF;
342 if ((category == TPM_PROTECTED_COMMAND && ordinal < TPM_MAX_ORDINAL) ||
343 (category == TPM_CONNECTION_COMMAND && ordinal < TSC_MAX_ORDINAL))
344 duration_idx = tpm_ordinal_duration[ordinal];
346 if (duration_idx != TPM_UNDEFINED)
347 duration = chip->vendor.duration[duration_idx];
353 EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
356 * Internal kernel interface to transmit TPM commands
358 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
365 if (bufsiz > TPM_BUFSIZE)
366 bufsiz = TPM_BUFSIZE;
368 count = be32_to_cpu(*((__be32 *) (buf + 2)));
369 ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
372 if (count > bufsiz) {
374 "invalid count value %x %zx \n", count, bufsiz);
378 mutex_lock(&chip->tpm_mutex);
380 if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
382 "tpm_transmit: tpm_send: error %zd\n", rc);
386 if (chip->vendor.irq)
389 stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
391 u8 status = chip->vendor.status(chip);
392 if ((status & chip->vendor.req_complete_mask) ==
393 chip->vendor.req_complete_val)
396 if (chip->vendor.req_canceled(chip, status)) {
397 dev_err(chip->dev, "Operation Canceled\n");
402 msleep(TPM_TIMEOUT); /* CHECK */
404 } while (time_before(jiffies, stop));
406 chip->vendor.cancel(chip);
407 dev_err(chip->dev, "Operation Timed out\n");
412 rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
415 "tpm_transmit: tpm_recv: error %zd\n", rc);
417 mutex_unlock(&chip->tpm_mutex);
421 #define TPM_DIGEST_SIZE 20
422 #define TPM_RET_CODE_IDX 6
424 enum tpm_capabilities {
425 TPM_CAP_FLAG = cpu_to_be32(4),
426 TPM_CAP_PROP = cpu_to_be32(5),
427 CAP_VERSION_1_1 = cpu_to_be32(0x06),
428 CAP_VERSION_1_2 = cpu_to_be32(0x1A)
431 enum tpm_sub_capabilities {
432 TPM_CAP_PROP_PCR = cpu_to_be32(0x101),
433 TPM_CAP_PROP_MANUFACTURER = cpu_to_be32(0x103),
434 TPM_CAP_FLAG_PERM = cpu_to_be32(0x108),
435 TPM_CAP_FLAG_VOL = cpu_to_be32(0x109),
436 TPM_CAP_PROP_OWNER = cpu_to_be32(0x111),
437 TPM_CAP_PROP_TIS_TIMEOUT = cpu_to_be32(0x115),
438 TPM_CAP_PROP_TIS_DURATION = cpu_to_be32(0x120),
442 static ssize_t transmit_cmd(struct tpm_chip *chip, struct tpm_cmd_t *cmd,
443 int len, const char *desc)
447 len = tpm_transmit(chip,(u8 *) cmd, len);
450 else if (len < TPM_HEADER_SIZE)
453 err = be32_to_cpu(cmd->header.out.return_code);
454 if (err != 0 && desc)
455 dev_err(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
460 #define TPM_INTERNAL_RESULT_SIZE 200
461 #define TPM_TAG_RQU_COMMAND cpu_to_be16(193)
462 #define TPM_ORD_GET_CAP cpu_to_be32(101)
463 #define TPM_ORD_GET_RANDOM cpu_to_be32(70)
465 static const struct tpm_input_header tpm_getcap_header = {
466 .tag = TPM_TAG_RQU_COMMAND,
467 .length = cpu_to_be32(22),
468 .ordinal = TPM_ORD_GET_CAP
471 ssize_t tpm_getcap(struct device *dev, __be32 subcap_id, cap_t *cap,
474 struct tpm_cmd_t tpm_cmd;
476 struct tpm_chip *chip = dev_get_drvdata(dev);
478 tpm_cmd.header.in = tpm_getcap_header;
479 if (subcap_id == CAP_VERSION_1_1 || subcap_id == CAP_VERSION_1_2) {
480 tpm_cmd.params.getcap_in.cap = subcap_id;
481 /*subcap field not necessary */
482 tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(0);
483 tpm_cmd.header.in.length -= cpu_to_be32(sizeof(__be32));
485 if (subcap_id == TPM_CAP_FLAG_PERM ||
486 subcap_id == TPM_CAP_FLAG_VOL)
487 tpm_cmd.params.getcap_in.cap = TPM_CAP_FLAG;
489 tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
490 tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
491 tpm_cmd.params.getcap_in.subcap = subcap_id;
493 rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, desc);
495 *cap = tpm_cmd.params.getcap_out.cap;
499 void tpm_gen_interrupt(struct tpm_chip *chip)
501 struct tpm_cmd_t tpm_cmd;
504 tpm_cmd.header.in = tpm_getcap_header;
505 tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
506 tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
507 tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
509 rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
510 "attempting to determine the timeouts");
512 EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
514 #define TPM_ORD_STARTUP cpu_to_be32(153)
515 #define TPM_ST_CLEAR cpu_to_be16(1)
516 #define TPM_ST_STATE cpu_to_be16(2)
517 #define TPM_ST_DEACTIVATED cpu_to_be16(3)
518 static const struct tpm_input_header tpm_startup_header = {
519 .tag = TPM_TAG_RQU_COMMAND,
520 .length = cpu_to_be32(12),
521 .ordinal = TPM_ORD_STARTUP
524 static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
526 struct tpm_cmd_t start_cmd;
527 start_cmd.header.in = tpm_startup_header;
528 start_cmd.params.startup_in.startup_type = startup_type;
529 return transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE,
530 "attempting to start the TPM");
533 int tpm_get_timeouts(struct tpm_chip *chip)
535 struct tpm_cmd_t tpm_cmd;
536 unsigned long new_timeout[4];
537 unsigned long old_timeout[4];
538 struct duration_t *duration_cap;
541 tpm_cmd.header.in = tpm_getcap_header;
542 tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
543 tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
544 tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
545 rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, NULL);
547 if (rc == TPM_ERR_INVALID_POSTINIT) {
548 /* The TPM is not started, we are the first to talk to it.
549 Execute a startup command. */
550 dev_info(chip->dev, "Issuing TPM_STARTUP");
551 if (tpm_startup(chip, TPM_ST_CLEAR))
554 tpm_cmd.header.in = tpm_getcap_header;
555 tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
556 tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
557 tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
558 rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
563 "A TPM error (%zd) occurred attempting to determine the timeouts\n",
568 if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
569 be32_to_cpu(tpm_cmd.header.out.length)
570 != sizeof(tpm_cmd.header.out) + sizeof(u32) + 4 * sizeof(u32))
573 old_timeout[0] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.a);
574 old_timeout[1] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.b);
575 old_timeout[2] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.c);
576 old_timeout[3] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.d);
577 memcpy(new_timeout, old_timeout, sizeof(new_timeout));
580 * Provide ability for vendor overrides of timeout values in case
583 if (chip->vendor.update_timeouts != NULL)
584 chip->vendor.timeout_adjusted =
585 chip->vendor.update_timeouts(chip, new_timeout);
587 if (!chip->vendor.timeout_adjusted) {
588 /* Don't overwrite default if value is 0 */
589 if (new_timeout[0] != 0 && new_timeout[0] < 1000) {
592 /* timeouts in msec rather usec */
593 for (i = 0; i != ARRAY_SIZE(new_timeout); i++)
594 new_timeout[i] *= 1000;
595 chip->vendor.timeout_adjusted = true;
599 /* Report adjusted timeouts */
600 if (chip->vendor.timeout_adjusted) {
602 HW_ERR "Adjusting reported timeouts: A %lu->%luus B %lu->%luus C %lu->%luus D %lu->%luus\n",
603 old_timeout[0], new_timeout[0],
604 old_timeout[1], new_timeout[1],
605 old_timeout[2], new_timeout[2],
606 old_timeout[3], new_timeout[3]);
609 chip->vendor.timeout_a = usecs_to_jiffies(new_timeout[0]);
610 chip->vendor.timeout_b = usecs_to_jiffies(new_timeout[1]);
611 chip->vendor.timeout_c = usecs_to_jiffies(new_timeout[2]);
612 chip->vendor.timeout_d = usecs_to_jiffies(new_timeout[3]);
615 tpm_cmd.header.in = tpm_getcap_header;
616 tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
617 tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
618 tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_DURATION;
620 rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
621 "attempting to determine the durations");
625 if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
626 be32_to_cpu(tpm_cmd.header.out.length)
627 != sizeof(tpm_cmd.header.out) + sizeof(u32) + 3 * sizeof(u32))
630 duration_cap = &tpm_cmd.params.getcap_out.cap.duration;
631 chip->vendor.duration[TPM_SHORT] =
632 usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_short));
633 chip->vendor.duration[TPM_MEDIUM] =
634 usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_medium));
635 chip->vendor.duration[TPM_LONG] =
636 usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_long));
638 /* The Broadcom BCM0102 chipset in a Dell Latitude D820 gets the above
639 * value wrong and apparently reports msecs rather than usecs. So we
640 * fix up the resulting too-small TPM_SHORT value to make things work.
641 * We also scale the TPM_MEDIUM and -_LONG values by 1000.
643 if (chip->vendor.duration[TPM_SHORT] < (HZ / 100)) {
644 chip->vendor.duration[TPM_SHORT] = HZ;
645 chip->vendor.duration[TPM_MEDIUM] *= 1000;
646 chip->vendor.duration[TPM_LONG] *= 1000;
647 chip->vendor.duration_adjusted = true;
648 dev_info(chip->dev, "Adjusting TPM timeout parameters.");
652 EXPORT_SYMBOL_GPL(tpm_get_timeouts);
654 #define TPM_ORD_CONTINUE_SELFTEST 83
655 #define CONTINUE_SELFTEST_RESULT_SIZE 10
657 static struct tpm_input_header continue_selftest_header = {
658 .tag = TPM_TAG_RQU_COMMAND,
659 .length = cpu_to_be32(10),
660 .ordinal = cpu_to_be32(TPM_ORD_CONTINUE_SELFTEST),
664 * tpm_continue_selftest -- run TPM's selftest
665 * @chip: TPM chip to use
667 * Returns 0 on success, < 0 in case of fatal error or a value > 0 representing
670 static int tpm_continue_selftest(struct tpm_chip *chip)
673 struct tpm_cmd_t cmd;
675 cmd.header.in = continue_selftest_header;
676 rc = transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE,
677 "continue selftest");
681 ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
687 rc = tpm_getcap(dev, TPM_CAP_FLAG_PERM, &cap,
688 "attempting to determine the permanent enabled state");
692 rc = sprintf(buf, "%d\n", !cap.perm_flags.disable);
695 EXPORT_SYMBOL_GPL(tpm_show_enabled);
697 ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
703 rc = tpm_getcap(dev, TPM_CAP_FLAG_PERM, &cap,
704 "attempting to determine the permanent active state");
708 rc = sprintf(buf, "%d\n", !cap.perm_flags.deactivated);
711 EXPORT_SYMBOL_GPL(tpm_show_active);
713 ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
719 rc = tpm_getcap(dev, TPM_CAP_PROP_OWNER, &cap,
720 "attempting to determine the owner state");
724 rc = sprintf(buf, "%d\n", cap.owned);
727 EXPORT_SYMBOL_GPL(tpm_show_owned);
729 ssize_t tpm_show_temp_deactivated(struct device * dev,
730 struct device_attribute * attr, char *buf)
735 rc = tpm_getcap(dev, TPM_CAP_FLAG_VOL, &cap,
736 "attempting to determine the temporary state");
740 rc = sprintf(buf, "%d\n", cap.stclear_flags.deactivated);
743 EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
746 * tpm_chip_find_get - return tpm_chip for given chip number
748 static struct tpm_chip *tpm_chip_find_get(int chip_num)
750 struct tpm_chip *pos, *chip = NULL;
753 list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
754 if (chip_num != TPM_ANY_NUM && chip_num != pos->dev_num)
757 if (try_module_get(pos->dev->driver->owner)) {
766 #define TPM_ORDINAL_PCRREAD cpu_to_be32(21)
767 #define READ_PCR_RESULT_SIZE 30
768 static struct tpm_input_header pcrread_header = {
769 .tag = TPM_TAG_RQU_COMMAND,
770 .length = cpu_to_be32(14),
771 .ordinal = TPM_ORDINAL_PCRREAD
774 static int __tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
777 struct tpm_cmd_t cmd;
779 cmd.header.in = pcrread_header;
780 cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
781 rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
782 "attempting to read a pcr value");
785 memcpy(res_buf, cmd.params.pcrread_out.pcr_result,
791 * tpm_pcr_read - read a pcr value
792 * @chip_num: tpm idx # or ANY
793 * @pcr_idx: pcr idx to retrieve
794 * @res_buf: TPM_PCR value
795 * size of res_buf is 20 bytes (or NULL if you don't care)
797 * The TPM driver should be built-in, but for whatever reason it
798 * isn't, protect against the chip disappearing, by incrementing
799 * the module usage count.
801 int tpm_pcr_read(u32 chip_num, int pcr_idx, u8 *res_buf)
803 struct tpm_chip *chip;
806 chip = tpm_chip_find_get(chip_num);
809 rc = __tpm_pcr_read(chip, pcr_idx, res_buf);
813 EXPORT_SYMBOL_GPL(tpm_pcr_read);
816 * tpm_pcr_extend - extend pcr value with hash
817 * @chip_num: tpm idx # or AN&
818 * @pcr_idx: pcr idx to extend
819 * @hash: hash value used to extend pcr value
821 * The TPM driver should be built-in, but for whatever reason it
822 * isn't, protect against the chip disappearing, by incrementing
823 * the module usage count.
825 #define TPM_ORD_PCR_EXTEND cpu_to_be32(20)
826 #define EXTEND_PCR_RESULT_SIZE 34
827 static struct tpm_input_header pcrextend_header = {
828 .tag = TPM_TAG_RQU_COMMAND,
829 .length = cpu_to_be32(34),
830 .ordinal = TPM_ORD_PCR_EXTEND
833 int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
835 struct tpm_cmd_t cmd;
837 struct tpm_chip *chip;
839 chip = tpm_chip_find_get(chip_num);
843 cmd.header.in = pcrextend_header;
844 cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
845 memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
846 rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
847 "attempting extend a PCR value");
852 EXPORT_SYMBOL_GPL(tpm_pcr_extend);
855 * tpm_do_selftest - have the TPM continue its selftest and wait until it
856 * can receive further commands
857 * @chip: TPM chip to use
859 * Returns 0 on success, < 0 in case of fatal error or a value > 0 representing
862 int tpm_do_selftest(struct tpm_chip *chip)
866 unsigned int delay_msec = 100;
867 unsigned long duration;
868 struct tpm_cmd_t cmd;
870 duration = tpm_calc_ordinal_duration(chip,
871 TPM_ORD_CONTINUE_SELFTEST);
873 loops = jiffies_to_msecs(duration) / delay_msec;
875 rc = tpm_continue_selftest(chip);
876 /* This may fail if there was no TPM driver during a suspend/resume
877 * cycle; some may return 10 (BAD_ORDINAL), others 28 (FAILEDSELFTEST)
883 /* Attempt to read a PCR value */
884 cmd.header.in = pcrread_header;
885 cmd.params.pcrread_in.pcr_idx = cpu_to_be32(0);
886 rc = tpm_transmit(chip, (u8 *) &cmd, READ_PCR_RESULT_SIZE);
887 /* Some buggy TPMs will not respond to tpm_tis_ready() for
888 * around 300ms while the self test is ongoing, keep trying
889 * until the self test duration expires. */
891 dev_info(chip->dev, HW_ERR "TPM command timed out during continue self test");
896 if (rc < TPM_HEADER_SIZE)
899 rc = be32_to_cpu(cmd.header.out.return_code);
900 if (rc == TPM_ERR_DISABLED || rc == TPM_ERR_DEACTIVATED) {
902 "TPM is disabled/deactivated (0x%X)\n", rc);
903 /* TPM is disabled and/or deactivated; driver can
904 * proceed and TPM does handle commands for
905 * suspend/resume correctly
909 if (rc != TPM_WARN_DOING_SELFTEST)
912 } while (--loops > 0);
916 EXPORT_SYMBOL_GPL(tpm_do_selftest);
918 int tpm_send(u32 chip_num, void *cmd, size_t buflen)
920 struct tpm_chip *chip;
923 chip = tpm_chip_find_get(chip_num);
927 rc = transmit_cmd(chip, cmd, buflen, "attempting tpm_cmd");
932 EXPORT_SYMBOL_GPL(tpm_send);
934 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
938 u8 digest[TPM_DIGEST_SIZE];
942 struct tpm_chip *chip = dev_get_drvdata(dev);
944 rc = tpm_getcap(dev, TPM_CAP_PROP_PCR, &cap,
945 "attempting to determine the number of PCRS");
949 num_pcrs = be32_to_cpu(cap.num_pcrs);
950 for (i = 0; i < num_pcrs; i++) {
951 rc = __tpm_pcr_read(chip, i, digest);
954 str += sprintf(str, "PCR-%02d: ", i);
955 for (j = 0; j < TPM_DIGEST_SIZE; j++)
956 str += sprintf(str, "%02X ", digest[j]);
957 str += sprintf(str, "\n");
961 EXPORT_SYMBOL_GPL(tpm_show_pcrs);
963 #define READ_PUBEK_RESULT_SIZE 314
964 #define TPM_ORD_READPUBEK cpu_to_be32(124)
965 static struct tpm_input_header tpm_readpubek_header = {
966 .tag = TPM_TAG_RQU_COMMAND,
967 .length = cpu_to_be32(30),
968 .ordinal = TPM_ORD_READPUBEK
971 ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
975 struct tpm_cmd_t tpm_cmd;
980 struct tpm_chip *chip = dev_get_drvdata(dev);
982 tpm_cmd.header.in = tpm_readpubek_header;
983 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
984 "attempting to read the PUBEK");
989 ignore header 10 bytes
990 algorithm 32 bits (1 == RSA )
993 parameters (RSA 12->bytes: keybit, #primes, expbit)
996 ignore checksum 20 bytes
998 data = tpm_cmd.params.readpubek_out_buffer;
1001 "Algorithm: %02X %02X %02X %02X\n"
1002 "Encscheme: %02X %02X\n"
1003 "Sigscheme: %02X %02X\n"
1004 "Parameters: %02X %02X %02X %02X "
1005 "%02X %02X %02X %02X "
1006 "%02X %02X %02X %02X\n"
1007 "Modulus length: %d\n"
1009 data[0], data[1], data[2], data[3],
1012 data[12], data[13], data[14], data[15],
1013 data[16], data[17], data[18], data[19],
1014 data[20], data[21], data[22], data[23],
1015 be32_to_cpu(*((__be32 *) (data + 24))));
1017 for (i = 0; i < 256; i++) {
1018 str += sprintf(str, "%02X ", data[i + 28]);
1019 if ((i + 1) % 16 == 0)
1020 str += sprintf(str, "\n");
1026 EXPORT_SYMBOL_GPL(tpm_show_pubek);
1029 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
1036 rc = tpm_getcap(dev, TPM_CAP_PROP_MANUFACTURER, &cap,
1037 "attempting to determine the manufacturer");
1040 str += sprintf(str, "Manufacturer: 0x%x\n",
1041 be32_to_cpu(cap.manufacturer_id));
1043 rc = tpm_getcap(dev, CAP_VERSION_1_1, &cap,
1044 "attempting to determine the 1.1 version");
1048 "TCG version: %d.%d\nFirmware version: %d.%d\n",
1049 cap.tpm_version.Major, cap.tpm_version.Minor,
1050 cap.tpm_version.revMajor, cap.tpm_version.revMinor);
1053 EXPORT_SYMBOL_GPL(tpm_show_caps);
1055 ssize_t tpm_show_caps_1_2(struct device * dev,
1056 struct device_attribute * attr, char *buf)
1062 rc = tpm_getcap(dev, TPM_CAP_PROP_MANUFACTURER, &cap,
1063 "attempting to determine the manufacturer");
1066 str += sprintf(str, "Manufacturer: 0x%x\n",
1067 be32_to_cpu(cap.manufacturer_id));
1068 rc = tpm_getcap(dev, CAP_VERSION_1_2, &cap,
1069 "attempting to determine the 1.2 version");
1073 "TCG version: %d.%d\nFirmware version: %d.%d\n",
1074 cap.tpm_version_1_2.Major, cap.tpm_version_1_2.Minor,
1075 cap.tpm_version_1_2.revMajor,
1076 cap.tpm_version_1_2.revMinor);
1079 EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
1081 ssize_t tpm_show_durations(struct device *dev, struct device_attribute *attr,
1084 struct tpm_chip *chip = dev_get_drvdata(dev);
1086 if (chip->vendor.duration[TPM_LONG] == 0)
1089 return sprintf(buf, "%d %d %d [%s]\n",
1090 jiffies_to_usecs(chip->vendor.duration[TPM_SHORT]),
1091 jiffies_to_usecs(chip->vendor.duration[TPM_MEDIUM]),
1092 jiffies_to_usecs(chip->vendor.duration[TPM_LONG]),
1093 chip->vendor.duration_adjusted
1094 ? "adjusted" : "original");
1096 EXPORT_SYMBOL_GPL(tpm_show_durations);
1098 ssize_t tpm_show_timeouts(struct device *dev, struct device_attribute *attr,
1101 struct tpm_chip *chip = dev_get_drvdata(dev);
1103 return sprintf(buf, "%d %d %d %d [%s]\n",
1104 jiffies_to_usecs(chip->vendor.timeout_a),
1105 jiffies_to_usecs(chip->vendor.timeout_b),
1106 jiffies_to_usecs(chip->vendor.timeout_c),
1107 jiffies_to_usecs(chip->vendor.timeout_d),
1108 chip->vendor.timeout_adjusted
1109 ? "adjusted" : "original");
1111 EXPORT_SYMBOL_GPL(tpm_show_timeouts);
1113 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
1114 const char *buf, size_t count)
1116 struct tpm_chip *chip = dev_get_drvdata(dev);
1120 chip->vendor.cancel(chip);
1123 EXPORT_SYMBOL_GPL(tpm_store_cancel);
1125 static bool wait_for_tpm_stat_cond(struct tpm_chip *chip, u8 mask, bool check_cancel,
1128 u8 status = chip->vendor.status(chip);
1131 if ((status & mask) == mask)
1133 if (check_cancel && chip->vendor.req_canceled(chip, status)) {
1140 int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
1141 wait_queue_head_t *queue, bool check_cancel)
1146 bool canceled = false;
1148 /* check current status */
1149 status = chip->vendor.status(chip);
1150 if ((status & mask) == mask)
1153 stop = jiffies + timeout;
1155 if (chip->vendor.irq) {
1157 timeout = stop - jiffies;
1158 if ((long)timeout <= 0)
1160 rc = wait_event_interruptible_timeout(*queue,
1161 wait_for_tpm_stat_cond(chip, mask, check_cancel,
1169 if (rc == -ERESTARTSYS && freezing(current)) {
1170 clear_thread_flag(TIF_SIGPENDING);
1175 msleep(TPM_TIMEOUT);
1176 status = chip->vendor.status(chip);
1177 if ((status & mask) == mask)
1179 } while (time_before(jiffies, stop));
1183 EXPORT_SYMBOL_GPL(wait_for_tpm_stat);
1185 * Device file system interface to the TPM
1187 * It's assured that the chip will be opened just once,
1188 * by the check of is_open variable, which is protected
1191 int tpm_open(struct inode *inode, struct file *file)
1193 int minor = iminor(inode);
1194 struct tpm_chip *chip = NULL, *pos;
1197 list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
1198 if (pos->vendor.miscdev.minor == minor) {
1200 get_device(chip->dev);
1209 if (test_and_set_bit(0, &chip->is_open)) {
1210 dev_dbg(chip->dev, "Another process owns this TPM\n");
1211 put_device(chip->dev);
1215 chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
1216 if (chip->data_buffer == NULL) {
1217 clear_bit(0, &chip->is_open);
1218 put_device(chip->dev);
1222 atomic_set(&chip->data_pending, 0);
1224 file->private_data = chip;
1227 EXPORT_SYMBOL_GPL(tpm_open);
1230 * Called on file close
1232 int tpm_release(struct inode *inode, struct file *file)
1234 struct tpm_chip *chip = file->private_data;
1236 del_singleshot_timer_sync(&chip->user_read_timer);
1237 flush_work(&chip->work);
1238 file->private_data = NULL;
1239 atomic_set(&chip->data_pending, 0);
1240 kzfree(chip->data_buffer);
1241 clear_bit(0, &chip->is_open);
1242 put_device(chip->dev);
1245 EXPORT_SYMBOL_GPL(tpm_release);
1247 ssize_t tpm_write(struct file *file, const char __user *buf,
1248 size_t size, loff_t *off)
1250 struct tpm_chip *chip = file->private_data;
1251 size_t in_size = size;
1254 /* cannot perform a write until the read has cleared
1255 either via tpm_read or a user_read_timer timeout.
1256 This also prevents splitted buffered writes from blocking here.
1258 if (atomic_read(&chip->data_pending) != 0)
1261 if (in_size > TPM_BUFSIZE)
1264 mutex_lock(&chip->buffer_mutex);
1267 (chip->data_buffer, (void __user *) buf, in_size)) {
1268 mutex_unlock(&chip->buffer_mutex);
1272 /* atomic tpm command send and result receive */
1273 out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
1275 mutex_unlock(&chip->buffer_mutex);
1279 atomic_set(&chip->data_pending, out_size);
1280 mutex_unlock(&chip->buffer_mutex);
1282 /* Set a timeout by which the reader must come claim the result */
1283 mod_timer(&chip->user_read_timer, jiffies + (60 * HZ));
1287 EXPORT_SYMBOL_GPL(tpm_write);
1289 ssize_t tpm_read(struct file *file, char __user *buf,
1290 size_t size, loff_t *off)
1292 struct tpm_chip *chip = file->private_data;
1296 del_singleshot_timer_sync(&chip->user_read_timer);
1297 flush_work(&chip->work);
1298 ret_size = atomic_read(&chip->data_pending);
1299 if (ret_size > 0) { /* relay data */
1300 ssize_t orig_ret_size = ret_size;
1301 if (size < ret_size)
1304 mutex_lock(&chip->buffer_mutex);
1305 rc = copy_to_user(buf, chip->data_buffer, ret_size);
1306 memset(chip->data_buffer, 0, orig_ret_size);
1310 mutex_unlock(&chip->buffer_mutex);
1313 atomic_set(&chip->data_pending, 0);
1317 EXPORT_SYMBOL_GPL(tpm_read);
1319 void tpm_remove_hardware(struct device *dev)
1321 struct tpm_chip *chip = dev_get_drvdata(dev);
1324 dev_err(dev, "No device data found\n");
1328 spin_lock(&driver_lock);
1329 list_del_rcu(&chip->list);
1330 spin_unlock(&driver_lock);
1333 misc_deregister(&chip->vendor.miscdev);
1334 sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
1335 tpm_remove_ppi(&dev->kobj);
1336 tpm_bios_log_teardown(chip->bios_dir);
1338 /* write it this way to be explicit (chip->dev == dev) */
1339 put_device(chip->dev);
1341 EXPORT_SYMBOL_GPL(tpm_remove_hardware);
1343 #define TPM_ORD_SAVESTATE cpu_to_be32(152)
1344 #define SAVESTATE_RESULT_SIZE 10
1346 static struct tpm_input_header savestate_header = {
1347 .tag = TPM_TAG_RQU_COMMAND,
1348 .length = cpu_to_be32(10),
1349 .ordinal = TPM_ORD_SAVESTATE
1353 * We are about to suspend. Save the TPM state
1354 * so that it can be restored.
1356 int tpm_pm_suspend(struct device *dev)
1358 struct tpm_chip *chip = dev_get_drvdata(dev);
1359 struct tpm_cmd_t cmd;
1362 u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
1367 /* for buggy tpm, flush pcrs with extend to selected dummy */
1368 if (tpm_suspend_pcr) {
1369 cmd.header.in = pcrextend_header;
1370 cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);
1371 memcpy(cmd.params.pcrextend_in.hash, dummy_hash,
1373 rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
1374 "extending dummy pcr before suspend");
1377 /* now do the actual savestate */
1378 for (try = 0; try < TPM_RETRY; try++) {
1379 cmd.header.in = savestate_header;
1380 rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);
1383 * If the TPM indicates that it is too busy to respond to
1384 * this command then retry before giving up. It can take
1385 * several seconds for this TPM to be ready.
1387 * This can happen if the TPM has already been sent the
1388 * SaveState command before the driver has loaded. TCG 1.2
1389 * specification states that any communication after SaveState
1390 * may cause the TPM to invalidate previously saved state.
1392 if (rc != TPM_WARN_RETRY)
1394 msleep(TPM_TIMEOUT_RETRY);
1399 "Error (%d) sending savestate before suspend\n", rc);
1401 dev_warn(chip->dev, "TPM savestate took %dms\n",
1402 try * TPM_TIMEOUT_RETRY);
1406 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
1409 * Resume from a power safe. The BIOS already restored
1412 int tpm_pm_resume(struct device *dev)
1414 struct tpm_chip *chip = dev_get_drvdata(dev);
1421 EXPORT_SYMBOL_GPL(tpm_pm_resume);
1423 #define TPM_GETRANDOM_RESULT_SIZE 18
1424 static struct tpm_input_header tpm_getrandom_header = {
1425 .tag = TPM_TAG_RQU_COMMAND,
1426 .length = cpu_to_be32(14),
1427 .ordinal = TPM_ORD_GET_RANDOM
1431 * tpm_get_random() - Get random bytes from the tpm's RNG
1432 * @chip_num: A specific chip number for the request or TPM_ANY_NUM
1433 * @out: destination buffer for the random bytes
1434 * @max: the max number of bytes to write to @out
1436 * Returns < 0 on error and the number of bytes read on success
1438 int tpm_get_random(u32 chip_num, u8 *out, size_t max)
1440 struct tpm_chip *chip;
1441 struct tpm_cmd_t tpm_cmd;
1442 u32 recd, num_bytes = min_t(u32, max, TPM_MAX_RNG_DATA);
1443 int err, total = 0, retries = 5;
1446 if (!out || !num_bytes || max > TPM_MAX_RNG_DATA)
1449 chip = tpm_chip_find_get(chip_num);
1454 tpm_cmd.header.in = tpm_getrandom_header;
1455 tpm_cmd.params.getrandom_in.num_bytes = cpu_to_be32(num_bytes);
1457 err = transmit_cmd(chip, &tpm_cmd,
1458 TPM_GETRANDOM_RESULT_SIZE + num_bytes,
1459 "attempting get random");
1463 recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len);
1464 memcpy(dest, tpm_cmd.params.getrandom_out.rng_data, recd);
1469 } while (retries-- && total < max);
1472 return total ? total : -EIO;
1474 EXPORT_SYMBOL_GPL(tpm_get_random);
1476 /* In case vendor provided release function, call it too.*/
1478 void tpm_dev_vendor_release(struct tpm_chip *chip)
1483 if (chip->vendor.release)
1484 chip->vendor.release(chip->dev);
1486 clear_bit(chip->dev_num, dev_mask);
1487 kfree(chip->vendor.miscdev.name);
1489 EXPORT_SYMBOL_GPL(tpm_dev_vendor_release);
1493 * Once all references to platform device are down to 0,
1494 * release all allocated structures.
1496 static void tpm_dev_release(struct device *dev)
1498 struct tpm_chip *chip = dev_get_drvdata(dev);
1503 tpm_dev_vendor_release(chip);
1508 EXPORT_SYMBOL_GPL(tpm_dev_release);
1511 * Called from tpm_<specific>.c probe function only for devices
1512 * the driver has determined it should claim. Prior to calling
1513 * this function the specific probe function has called pci_enable_device
1514 * upon errant exit from this function specific probe function should call
1515 * pci_disable_device
1517 struct tpm_chip *tpm_register_hardware(struct device *dev,
1518 const struct tpm_vendor_specific *entry)
1520 #define DEVNAME_SIZE 7
1523 struct tpm_chip *chip;
1525 /* Driver specific per-device data */
1526 chip = kzalloc(sizeof(*chip), GFP_KERNEL);
1527 devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
1529 if (chip == NULL || devname == NULL)
1532 mutex_init(&chip->buffer_mutex);
1533 mutex_init(&chip->tpm_mutex);
1534 INIT_LIST_HEAD(&chip->list);
1536 INIT_WORK(&chip->work, timeout_work);
1538 setup_timer(&chip->user_read_timer, user_reader_timeout,
1539 (unsigned long)chip);
1541 memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
1543 chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
1545 if (chip->dev_num >= TPM_NUM_DEVICES) {
1546 dev_err(dev, "No available tpm device numbers\n");
1548 } else if (chip->dev_num == 0)
1549 chip->vendor.miscdev.minor = TPM_MINOR;
1551 chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
1553 set_bit(chip->dev_num, dev_mask);
1555 scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
1556 chip->vendor.miscdev.name = devname;
1558 chip->vendor.miscdev.parent = dev;
1559 chip->dev = get_device(dev);
1560 chip->release = dev->release;
1561 dev->release = tpm_dev_release;
1562 dev_set_drvdata(dev, chip);
1564 if (misc_register(&chip->vendor.miscdev)) {
1566 "unable to misc_register %s, minor %d\n",
1567 chip->vendor.miscdev.name,
1568 chip->vendor.miscdev.minor);
1572 if (sysfs_create_group(&dev->kobj, chip->vendor.attr_group)) {
1573 misc_deregister(&chip->vendor.miscdev);
1577 if (tpm_add_ppi(&dev->kobj)) {
1578 misc_deregister(&chip->vendor.miscdev);
1582 chip->bios_dir = tpm_bios_log_setup(devname);
1584 /* Make chip available */
1585 spin_lock(&driver_lock);
1586 list_add_rcu(&chip->list, &tpm_chip_list);
1587 spin_unlock(&driver_lock);
1592 put_device(chip->dev);
1598 EXPORT_SYMBOL_GPL(tpm_register_hardware);
1600 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
1601 MODULE_DESCRIPTION("TPM Driver");
1602 MODULE_VERSION("2.0");
1603 MODULE_LICENSE("GPL");