linux/drivers/char/tpm/tpm.c
<<
>>
Prefs
   1/*
   2 * Copyright (C) 2004 IBM Corporation
   3 *
   4 * Authors:
   5 * Leendert van Doorn <leendert@watson.ibm.com>
   6 * Dave Safford <safford@watson.ibm.com>
   7 * Reiner Sailer <sailer@watson.ibm.com>
   8 * Kylene Hall <kjhall@us.ibm.com>
   9 *
  10 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
  11 *
  12 * Device driver for TCG/TCPA TPM (trusted platform module).
  13 * Specifications at www.trustedcomputinggroup.org       
  14 *
  15 * This program is free software; you can redistribute it and/or
  16 * modify it under the terms of the GNU General Public License as
  17 * published by the Free Software Foundation, version 2 of the
  18 * License.
  19 * 
  20 * Note, the TPM chip is not interrupt driven (only polling)
  21 * and can have very long timeouts (minutes!). Hence the unusual
  22 * calls to msleep.
  23 *
  24 */
  25
  26#include <linux/poll.h>
  27#include <linux/slab.h>
  28#include <linux/mutex.h>
  29#include <linux/spinlock.h>
  30#include <linux/freezer.h>
  31
  32#include "tpm.h"
  33#include "tpm_eventlog.h"
  34
  35enum tpm_duration {
  36        TPM_SHORT = 0,
  37        TPM_MEDIUM = 1,
  38        TPM_LONG = 2,
  39        TPM_UNDEFINED,
  40};
  41
  42#define TPM_MAX_ORDINAL 243
  43#define TSC_MAX_ORDINAL 12
  44#define TPM_PROTECTED_COMMAND 0x00
  45#define TPM_CONNECTION_COMMAND 0x40
  46
  47/*
  48 * Bug workaround - some TPM's don't flush the most
  49 * recently changed pcr on suspend, so force the flush
  50 * with an extend to the selected _unused_ non-volatile pcr.
  51 */
  52static int tpm_suspend_pcr;
  53module_param_named(suspend_pcr, tpm_suspend_pcr, uint, 0644);
  54MODULE_PARM_DESC(suspend_pcr,
  55                 "PCR to use for dummy writes to faciltate flush on suspend.");
  56
  57static LIST_HEAD(tpm_chip_list);
  58static DEFINE_SPINLOCK(driver_lock);
  59static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
  60
  61/*
  62 * Array with one entry per ordinal defining the maximum amount
  63 * of time the chip could take to return the result.  The ordinal
  64 * designation of short, medium or long is defined in a table in
  65 * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
  66 * values of the SHORT, MEDIUM, and LONG durations are retrieved
  67 * from the chip during initialization with a call to tpm_get_timeouts.
  68 */
  69static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
  70        TPM_UNDEFINED,          /* 0 */
  71        TPM_UNDEFINED,
  72        TPM_UNDEFINED,
  73        TPM_UNDEFINED,
  74        TPM_UNDEFINED,
  75        TPM_UNDEFINED,          /* 5 */
  76        TPM_UNDEFINED,
  77        TPM_UNDEFINED,
  78        TPM_UNDEFINED,
  79        TPM_UNDEFINED,
  80        TPM_SHORT,              /* 10 */
  81        TPM_SHORT,
  82        TPM_MEDIUM,
  83        TPM_LONG,
  84        TPM_LONG,
  85        TPM_MEDIUM,             /* 15 */
  86        TPM_SHORT,
  87        TPM_SHORT,
  88        TPM_MEDIUM,
  89        TPM_LONG,
  90        TPM_SHORT,              /* 20 */
  91        TPM_SHORT,
  92        TPM_MEDIUM,
  93        TPM_MEDIUM,
  94        TPM_MEDIUM,
  95        TPM_SHORT,              /* 25 */
  96        TPM_SHORT,
  97        TPM_MEDIUM,
  98        TPM_SHORT,
  99        TPM_SHORT,
 100        TPM_MEDIUM,             /* 30 */
 101        TPM_LONG,
 102        TPM_MEDIUM,
 103        TPM_SHORT,
 104        TPM_SHORT,
 105        TPM_SHORT,              /* 35 */
 106        TPM_MEDIUM,
 107        TPM_MEDIUM,
 108        TPM_UNDEFINED,
 109        TPM_UNDEFINED,
 110        TPM_MEDIUM,             /* 40 */
 111        TPM_LONG,
 112        TPM_MEDIUM,
 113        TPM_SHORT,
 114        TPM_SHORT,
 115        TPM_SHORT,              /* 45 */
 116        TPM_SHORT,
 117        TPM_SHORT,
 118        TPM_SHORT,
 119        TPM_LONG,
 120        TPM_MEDIUM,             /* 50 */
 121        TPM_MEDIUM,
 122        TPM_UNDEFINED,
 123        TPM_UNDEFINED,
 124        TPM_UNDEFINED,
 125        TPM_UNDEFINED,          /* 55 */
 126        TPM_UNDEFINED,
 127        TPM_UNDEFINED,
 128        TPM_UNDEFINED,
 129        TPM_UNDEFINED,
 130        TPM_MEDIUM,             /* 60 */
 131        TPM_MEDIUM,
 132        TPM_MEDIUM,
 133        TPM_SHORT,
 134        TPM_SHORT,
 135        TPM_MEDIUM,             /* 65 */
 136        TPM_UNDEFINED,
 137        TPM_UNDEFINED,
 138        TPM_UNDEFINED,
 139        TPM_UNDEFINED,
 140        TPM_SHORT,              /* 70 */
 141        TPM_SHORT,
 142        TPM_UNDEFINED,
 143        TPM_UNDEFINED,
 144        TPM_UNDEFINED,
 145        TPM_UNDEFINED,          /* 75 */
 146        TPM_UNDEFINED,
 147        TPM_UNDEFINED,
 148        TPM_UNDEFINED,
 149        TPM_UNDEFINED,
 150        TPM_LONG,               /* 80 */
 151        TPM_UNDEFINED,
 152        TPM_MEDIUM,
 153        TPM_LONG,
 154        TPM_SHORT,
 155        TPM_UNDEFINED,          /* 85 */
 156        TPM_UNDEFINED,
 157        TPM_UNDEFINED,
 158        TPM_UNDEFINED,
 159        TPM_UNDEFINED,
 160        TPM_SHORT,              /* 90 */
 161        TPM_SHORT,
 162        TPM_SHORT,
 163        TPM_SHORT,
 164        TPM_SHORT,
 165        TPM_UNDEFINED,          /* 95 */
 166        TPM_UNDEFINED,
 167        TPM_UNDEFINED,
 168        TPM_UNDEFINED,
 169        TPM_UNDEFINED,
 170        TPM_MEDIUM,             /* 100 */
 171        TPM_SHORT,
 172        TPM_SHORT,
 173        TPM_UNDEFINED,
 174        TPM_UNDEFINED,
 175        TPM_UNDEFINED,          /* 105 */
 176        TPM_UNDEFINED,
 177        TPM_UNDEFINED,
 178        TPM_UNDEFINED,
 179        TPM_UNDEFINED,
 180        TPM_SHORT,              /* 110 */
 181        TPM_SHORT,
 182        TPM_SHORT,
 183        TPM_SHORT,
 184        TPM_SHORT,
 185        TPM_SHORT,              /* 115 */
 186        TPM_SHORT,
 187        TPM_SHORT,
 188        TPM_UNDEFINED,
 189        TPM_UNDEFINED,
 190        TPM_LONG,               /* 120 */
 191        TPM_LONG,
 192        TPM_MEDIUM,
 193        TPM_UNDEFINED,
 194        TPM_SHORT,
 195        TPM_SHORT,              /* 125 */
 196        TPM_SHORT,
 197        TPM_LONG,
 198        TPM_SHORT,
 199        TPM_SHORT,
 200        TPM_SHORT,              /* 130 */
 201        TPM_MEDIUM,
 202        TPM_UNDEFINED,
 203        TPM_SHORT,
 204        TPM_MEDIUM,
 205        TPM_UNDEFINED,          /* 135 */
 206        TPM_UNDEFINED,
 207        TPM_UNDEFINED,
 208        TPM_UNDEFINED,
 209        TPM_UNDEFINED,
 210        TPM_SHORT,              /* 140 */
 211        TPM_SHORT,
 212        TPM_UNDEFINED,
 213        TPM_UNDEFINED,
 214        TPM_UNDEFINED,
 215        TPM_UNDEFINED,          /* 145 */
 216        TPM_UNDEFINED,
 217        TPM_UNDEFINED,
 218        TPM_UNDEFINED,
 219        TPM_UNDEFINED,
 220        TPM_SHORT,              /* 150 */
 221        TPM_MEDIUM,
 222        TPM_MEDIUM,
 223        TPM_SHORT,
 224        TPM_SHORT,
 225        TPM_UNDEFINED,          /* 155 */
 226        TPM_UNDEFINED,
 227        TPM_UNDEFINED,
 228        TPM_UNDEFINED,
 229        TPM_UNDEFINED,
 230        TPM_SHORT,              /* 160 */
 231        TPM_SHORT,
 232        TPM_SHORT,
 233        TPM_SHORT,
 234        TPM_UNDEFINED,
 235        TPM_UNDEFINED,          /* 165 */
 236        TPM_UNDEFINED,
 237        TPM_UNDEFINED,
 238        TPM_UNDEFINED,
 239        TPM_UNDEFINED,
 240        TPM_LONG,               /* 170 */
 241        TPM_UNDEFINED,
 242        TPM_UNDEFINED,
 243        TPM_UNDEFINED,
 244        TPM_UNDEFINED,
 245        TPM_UNDEFINED,          /* 175 */
 246        TPM_UNDEFINED,
 247        TPM_UNDEFINED,
 248        TPM_UNDEFINED,
 249        TPM_UNDEFINED,
 250        TPM_MEDIUM,             /* 180 */
 251        TPM_SHORT,
 252        TPM_MEDIUM,
 253        TPM_MEDIUM,
 254        TPM_MEDIUM,
 255        TPM_MEDIUM,             /* 185 */
 256        TPM_SHORT,
 257        TPM_UNDEFINED,
 258        TPM_UNDEFINED,
 259        TPM_UNDEFINED,
 260        TPM_UNDEFINED,          /* 190 */
 261        TPM_UNDEFINED,
 262        TPM_UNDEFINED,
 263        TPM_UNDEFINED,
 264        TPM_UNDEFINED,
 265        TPM_UNDEFINED,          /* 195 */
 266        TPM_UNDEFINED,
 267        TPM_UNDEFINED,
 268        TPM_UNDEFINED,
 269        TPM_UNDEFINED,
 270        TPM_SHORT,              /* 200 */
 271        TPM_UNDEFINED,
 272        TPM_UNDEFINED,
 273        TPM_UNDEFINED,
 274        TPM_SHORT,
 275        TPM_SHORT,              /* 205 */
 276        TPM_SHORT,
 277        TPM_SHORT,
 278        TPM_SHORT,
 279        TPM_SHORT,
 280        TPM_MEDIUM,             /* 210 */
 281        TPM_UNDEFINED,
 282        TPM_MEDIUM,
 283        TPM_MEDIUM,
 284        TPM_MEDIUM,
 285        TPM_UNDEFINED,          /* 215 */
 286        TPM_MEDIUM,
 287        TPM_UNDEFINED,
 288        TPM_UNDEFINED,
 289        TPM_SHORT,
 290        TPM_SHORT,              /* 220 */
 291        TPM_SHORT,
 292        TPM_SHORT,
 293        TPM_SHORT,
 294        TPM_SHORT,
 295        TPM_UNDEFINED,          /* 225 */
 296        TPM_UNDEFINED,
 297        TPM_UNDEFINED,
 298        TPM_UNDEFINED,
 299        TPM_UNDEFINED,
 300        TPM_SHORT,              /* 230 */
 301        TPM_LONG,
 302        TPM_MEDIUM,
 303        TPM_UNDEFINED,
 304        TPM_UNDEFINED,
 305        TPM_UNDEFINED,          /* 235 */
 306        TPM_UNDEFINED,
 307        TPM_UNDEFINED,
 308        TPM_UNDEFINED,
 309        TPM_UNDEFINED,
 310        TPM_SHORT,              /* 240 */
 311        TPM_UNDEFINED,
 312        TPM_MEDIUM,
 313};
 314
 315static void user_reader_timeout(unsigned long ptr)
 316{
 317        struct tpm_chip *chip = (struct tpm_chip *) ptr;
 318
 319        schedule_work(&chip->work);
 320}
 321
 322static void timeout_work(struct work_struct *work)
 323{
 324        struct tpm_chip *chip = container_of(work, struct tpm_chip, work);
 325
 326        mutex_lock(&chip->buffer_mutex);
 327        atomic_set(&chip->data_pending, 0);
 328        memset(chip->data_buffer, 0, TPM_BUFSIZE);
 329        mutex_unlock(&chip->buffer_mutex);
 330}
 331
 332/*
 333 * Returns max number of jiffies to wait
 334 */
 335unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
 336                                           u32 ordinal)
 337{
 338        int duration_idx = TPM_UNDEFINED;
 339        int duration = 0;
 340        u8 category = (ordinal >> 24) & 0xFF;
 341
 342        if ((category == TPM_PROTECTED_COMMAND && ordinal < TPM_MAX_ORDINAL) ||
 343            (category == TPM_CONNECTION_COMMAND && ordinal < TSC_MAX_ORDINAL))
 344                duration_idx = tpm_ordinal_duration[ordinal];
 345
 346        if (duration_idx != TPM_UNDEFINED)
 347                duration = chip->vendor.duration[duration_idx];
 348        if (duration <= 0)
 349                return 2 * 60 * HZ;
 350        else
 351                return duration;
 352}
 353EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
 354
 355/*
 356 * Internal kernel interface to transmit TPM commands
 357 */
 358static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
 359                            size_t bufsiz)
 360{
 361        ssize_t rc;
 362        u32 count, ordinal;
 363        unsigned long stop;
 364
 365        if (bufsiz > TPM_BUFSIZE)
 366                bufsiz = TPM_BUFSIZE;
 367
 368        count = be32_to_cpu(*((__be32 *) (buf + 2)));
 369        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
 370        if (count == 0)
 371                return -ENODATA;
 372        if (count > bufsiz) {
 373                dev_err(chip->dev,
 374                        "invalid count value %x %zx \n", count, bufsiz);
 375                return -E2BIG;
 376        }
 377
 378        mutex_lock(&chip->tpm_mutex);
 379
 380        if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
 381                dev_err(chip->dev,
 382                        "tpm_transmit: tpm_send: error %zd\n", rc);
 383                goto out;
 384        }
 385
 386        if (chip->vendor.irq)
 387                goto out_recv;
 388
 389        stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
 390        do {
 391                u8 status = chip->vendor.status(chip);
 392                if ((status & chip->vendor.req_complete_mask) ==
 393                    chip->vendor.req_complete_val)
 394                        goto out_recv;
 395
 396                if (chip->vendor.req_canceled(chip, status)) {
 397                        dev_err(chip->dev, "Operation Canceled\n");
 398                        rc = -ECANCELED;
 399                        goto out;
 400                }
 401
 402                msleep(TPM_TIMEOUT);    /* CHECK */
 403                rmb();
 404        } while (time_before(jiffies, stop));
 405
 406        chip->vendor.cancel(chip);
 407        dev_err(chip->dev, "Operation Timed out\n");
 408        rc = -ETIME;
 409        goto out;
 410
 411out_recv:
 412        rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
 413        if (rc < 0)
 414                dev_err(chip->dev,
 415                        "tpm_transmit: tpm_recv: error %zd\n", rc);
 416out:
 417        mutex_unlock(&chip->tpm_mutex);
 418        return rc;
 419}
 420
 421#define TPM_DIGEST_SIZE 20
 422#define TPM_RET_CODE_IDX 6
 423
 424enum tpm_capabilities {
 425        TPM_CAP_FLAG = cpu_to_be32(4),
 426        TPM_CAP_PROP = cpu_to_be32(5),
 427        CAP_VERSION_1_1 = cpu_to_be32(0x06),
 428        CAP_VERSION_1_2 = cpu_to_be32(0x1A)
 429};
 430
 431enum tpm_sub_capabilities {
 432        TPM_CAP_PROP_PCR = cpu_to_be32(0x101),
 433        TPM_CAP_PROP_MANUFACTURER = cpu_to_be32(0x103),
 434        TPM_CAP_FLAG_PERM = cpu_to_be32(0x108),
 435        TPM_CAP_FLAG_VOL = cpu_to_be32(0x109),
 436        TPM_CAP_PROP_OWNER = cpu_to_be32(0x111),
 437        TPM_CAP_PROP_TIS_TIMEOUT = cpu_to_be32(0x115),
 438        TPM_CAP_PROP_TIS_DURATION = cpu_to_be32(0x120),
 439
 440};
 441
 442static ssize_t transmit_cmd(struct tpm_chip *chip, struct tpm_cmd_t *cmd,
 443                            int len, const char *desc)
 444{
 445        int err;
 446
 447        len = tpm_transmit(chip,(u8 *) cmd, len);
 448        if (len <  0)
 449                return len;
 450        else if (len < TPM_HEADER_SIZE)
 451                return -EFAULT;
 452
 453        err = be32_to_cpu(cmd->header.out.return_code);
 454        if (err != 0 && desc)
 455                dev_err(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
 456
 457        return err;
 458}
 459
 460#define TPM_INTERNAL_RESULT_SIZE 200
 461#define TPM_TAG_RQU_COMMAND cpu_to_be16(193)
 462#define TPM_ORD_GET_CAP cpu_to_be32(101)
 463#define TPM_ORD_GET_RANDOM cpu_to_be32(70)
 464
 465static const struct tpm_input_header tpm_getcap_header = {
 466        .tag = TPM_TAG_RQU_COMMAND,
 467        .length = cpu_to_be32(22),
 468        .ordinal = TPM_ORD_GET_CAP
 469};
 470
 471ssize_t tpm_getcap(struct device *dev, __be32 subcap_id, cap_t *cap,
 472                   const char *desc)
 473{
 474        struct tpm_cmd_t tpm_cmd;
 475        int rc;
 476        struct tpm_chip *chip = dev_get_drvdata(dev);
 477
 478        tpm_cmd.header.in = tpm_getcap_header;
 479        if (subcap_id == CAP_VERSION_1_1 || subcap_id == CAP_VERSION_1_2) {
 480                tpm_cmd.params.getcap_in.cap = subcap_id;
 481                /*subcap field not necessary */
 482                tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(0);
 483                tpm_cmd.header.in.length -= cpu_to_be32(sizeof(__be32));
 484        } else {
 485                if (subcap_id == TPM_CAP_FLAG_PERM ||
 486                    subcap_id == TPM_CAP_FLAG_VOL)
 487                        tpm_cmd.params.getcap_in.cap = TPM_CAP_FLAG;
 488                else
 489                        tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
 490                tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
 491                tpm_cmd.params.getcap_in.subcap = subcap_id;
 492        }
 493        rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, desc);
 494        if (!rc)
 495                *cap = tpm_cmd.params.getcap_out.cap;
 496        return rc;
 497}
 498
 499void tpm_gen_interrupt(struct tpm_chip *chip)
 500{
 501        struct  tpm_cmd_t tpm_cmd;
 502        ssize_t rc;
 503
 504        tpm_cmd.header.in = tpm_getcap_header;
 505        tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
 506        tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
 507        tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
 508
 509        rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
 510                        "attempting to determine the timeouts");
 511}
 512EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
 513
 514#define TPM_ORD_STARTUP cpu_to_be32(153)
 515#define TPM_ST_CLEAR cpu_to_be16(1)
 516#define TPM_ST_STATE cpu_to_be16(2)
 517#define TPM_ST_DEACTIVATED cpu_to_be16(3)
 518static const struct tpm_input_header tpm_startup_header = {
 519        .tag = TPM_TAG_RQU_COMMAND,
 520        .length = cpu_to_be32(12),
 521        .ordinal = TPM_ORD_STARTUP
 522};
 523
 524static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
 525{
 526        struct tpm_cmd_t start_cmd;
 527        start_cmd.header.in = tpm_startup_header;
 528        start_cmd.params.startup_in.startup_type = startup_type;
 529        return transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE,
 530                            "attempting to start the TPM");
 531}
 532
 533int tpm_get_timeouts(struct tpm_chip *chip)
 534{
 535        struct tpm_cmd_t tpm_cmd;
 536        struct timeout_t *timeout_cap;
 537        struct duration_t *duration_cap;
 538        ssize_t rc;
 539        u32 timeout;
 540        unsigned int scale = 1;
 541
 542        tpm_cmd.header.in = tpm_getcap_header;
 543        tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
 544        tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
 545        tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
 546        rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, NULL);
 547
 548        if (rc == TPM_ERR_INVALID_POSTINIT) {
 549                /* The TPM is not started, we are the first to talk to it.
 550                   Execute a startup command. */
 551                dev_info(chip->dev, "Issuing TPM_STARTUP");
 552                if (tpm_startup(chip, TPM_ST_CLEAR))
 553                        return rc;
 554
 555                tpm_cmd.header.in = tpm_getcap_header;
 556                tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
 557                tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
 558                tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
 559                rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
 560                                  NULL);
 561        }
 562        if (rc) {
 563                dev_err(chip->dev,
 564                        "A TPM error (%zd) occurred attempting to determine the timeouts\n",
 565                        rc);
 566                goto duration;
 567        }
 568
 569        if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
 570            be32_to_cpu(tpm_cmd.header.out.length)
 571            != sizeof(tpm_cmd.header.out) + sizeof(u32) + 4 * sizeof(u32))
 572                return -EINVAL;
 573
 574        timeout_cap = &tpm_cmd.params.getcap_out.cap.timeout;
 575        /* Don't overwrite default if value is 0 */
 576        timeout = be32_to_cpu(timeout_cap->a);
 577        if (timeout && timeout < 1000) {
 578                /* timeouts in msec rather usec */
 579                scale = 1000;
 580                chip->vendor.timeout_adjusted = true;
 581        }
 582        if (timeout)
 583                chip->vendor.timeout_a = usecs_to_jiffies(timeout * scale);
 584        timeout = be32_to_cpu(timeout_cap->b);
 585        if (timeout)
 586                chip->vendor.timeout_b = usecs_to_jiffies(timeout * scale);
 587        timeout = be32_to_cpu(timeout_cap->c);
 588        if (timeout)
 589                chip->vendor.timeout_c = usecs_to_jiffies(timeout * scale);
 590        timeout = be32_to_cpu(timeout_cap->d);
 591        if (timeout)
 592                chip->vendor.timeout_d = usecs_to_jiffies(timeout * scale);
 593
 594duration:
 595        tpm_cmd.header.in = tpm_getcap_header;
 596        tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
 597        tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
 598        tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_DURATION;
 599
 600        rc = transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
 601                        "attempting to determine the durations");
 602        if (rc)
 603                return rc;
 604
 605        if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
 606            be32_to_cpu(tpm_cmd.header.out.length)
 607            != sizeof(tpm_cmd.header.out) + sizeof(u32) + 3 * sizeof(u32))
 608                return -EINVAL;
 609
 610        duration_cap = &tpm_cmd.params.getcap_out.cap.duration;
 611        chip->vendor.duration[TPM_SHORT] =
 612            usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_short));
 613        chip->vendor.duration[TPM_MEDIUM] =
 614            usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_medium));
 615        chip->vendor.duration[TPM_LONG] =
 616            usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_long));
 617
 618        /* The Broadcom BCM0102 chipset in a Dell Latitude D820 gets the above
 619         * value wrong and apparently reports msecs rather than usecs. So we
 620         * fix up the resulting too-small TPM_SHORT value to make things work.
 621         * We also scale the TPM_MEDIUM and -_LONG values by 1000.
 622         */
 623        if (chip->vendor.duration[TPM_SHORT] < (HZ / 100)) {
 624                chip->vendor.duration[TPM_SHORT] = HZ;
 625                chip->vendor.duration[TPM_MEDIUM] *= 1000;
 626                chip->vendor.duration[TPM_LONG] *= 1000;
 627                chip->vendor.duration_adjusted = true;
 628                dev_info(chip->dev, "Adjusting TPM timeout parameters.");
 629        }
 630        return 0;
 631}
 632EXPORT_SYMBOL_GPL(tpm_get_timeouts);
 633
 634#define TPM_ORD_CONTINUE_SELFTEST 83
 635#define CONTINUE_SELFTEST_RESULT_SIZE 10
 636
 637static struct tpm_input_header continue_selftest_header = {
 638        .tag = TPM_TAG_RQU_COMMAND,
 639        .length = cpu_to_be32(10),
 640        .ordinal = cpu_to_be32(TPM_ORD_CONTINUE_SELFTEST),
 641};
 642
 643/**
 644 * tpm_continue_selftest -- run TPM's selftest
 645 * @chip: TPM chip to use
 646 *
 647 * Returns 0 on success, < 0 in case of fatal error or a value > 0 representing
 648 * a TPM error code.
 649 */
 650static int tpm_continue_selftest(struct tpm_chip *chip)
 651{
 652        int rc;
 653        struct tpm_cmd_t cmd;
 654
 655        cmd.header.in = continue_selftest_header;
 656        rc = transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE,
 657                          "continue selftest");
 658        return rc;
 659}
 660
 661ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
 662                        char *buf)
 663{
 664        cap_t cap;
 665        ssize_t rc;
 666
 667        rc = tpm_getcap(dev, TPM_CAP_FLAG_PERM, &cap,
 668                         "attempting to determine the permanent enabled state");
 669        if (rc)
 670                return 0;
 671
 672        rc = sprintf(buf, "%d\n", !cap.perm_flags.disable);
 673        return rc;
 674}
 675EXPORT_SYMBOL_GPL(tpm_show_enabled);
 676
 677ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
 678                        char *buf)
 679{
 680        cap_t cap;
 681        ssize_t rc;
 682
 683        rc = tpm_getcap(dev, TPM_CAP_FLAG_PERM, &cap,
 684                         "attempting to determine the permanent active state");
 685        if (rc)
 686                return 0;
 687
 688        rc = sprintf(buf, "%d\n", !cap.perm_flags.deactivated);
 689        return rc;
 690}
 691EXPORT_SYMBOL_GPL(tpm_show_active);
 692
 693ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
 694                        char *buf)
 695{
 696        cap_t cap;
 697        ssize_t rc;
 698
 699        rc = tpm_getcap(dev, TPM_CAP_PROP_OWNER, &cap,
 700                         "attempting to determine the owner state");
 701        if (rc)
 702                return 0;
 703
 704        rc = sprintf(buf, "%d\n", cap.owned);
 705        return rc;
 706}
 707EXPORT_SYMBOL_GPL(tpm_show_owned);
 708
 709ssize_t tpm_show_temp_deactivated(struct device * dev,
 710                                struct device_attribute * attr, char *buf)
 711{
 712        cap_t cap;
 713        ssize_t rc;
 714
 715        rc = tpm_getcap(dev, TPM_CAP_FLAG_VOL, &cap,
 716                         "attempting to determine the temporary state");
 717        if (rc)
 718                return 0;
 719
 720        rc = sprintf(buf, "%d\n", cap.stclear_flags.deactivated);
 721        return rc;
 722}
 723EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
 724
 725/*
 726 * tpm_chip_find_get - return tpm_chip for given chip number
 727 */
 728static struct tpm_chip *tpm_chip_find_get(int chip_num)
 729{
 730        struct tpm_chip *pos, *chip = NULL;
 731
 732        rcu_read_lock();
 733        list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
 734                if (chip_num != TPM_ANY_NUM && chip_num != pos->dev_num)
 735                        continue;
 736
 737                if (try_module_get(pos->dev->driver->owner)) {
 738                        chip = pos;
 739                        break;
 740                }
 741        }
 742        rcu_read_unlock();
 743        return chip;
 744}
 745
 746#define TPM_ORDINAL_PCRREAD cpu_to_be32(21)
 747#define READ_PCR_RESULT_SIZE 30
 748static struct tpm_input_header pcrread_header = {
 749        .tag = TPM_TAG_RQU_COMMAND,
 750        .length = cpu_to_be32(14),
 751        .ordinal = TPM_ORDINAL_PCRREAD
 752};
 753
 754static int __tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
 755{
 756        int rc;
 757        struct tpm_cmd_t cmd;
 758
 759        cmd.header.in = pcrread_header;
 760        cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
 761        rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
 762                          "attempting to read a pcr value");
 763
 764        if (rc == 0)
 765                memcpy(res_buf, cmd.params.pcrread_out.pcr_result,
 766                       TPM_DIGEST_SIZE);
 767        return rc;
 768}
 769
 770/**
 771 * tpm_pcr_read - read a pcr value
 772 * @chip_num:   tpm idx # or ANY
 773 * @pcr_idx:    pcr idx to retrieve
 774 * @res_buf:    TPM_PCR value
 775 *              size of res_buf is 20 bytes (or NULL if you don't care)
 776 *
 777 * The TPM driver should be built-in, but for whatever reason it
 778 * isn't, protect against the chip disappearing, by incrementing
 779 * the module usage count.
 780 */
 781int tpm_pcr_read(u32 chip_num, int pcr_idx, u8 *res_buf)
 782{
 783        struct tpm_chip *chip;
 784        int rc;
 785
 786        chip = tpm_chip_find_get(chip_num);
 787        if (chip == NULL)
 788                return -ENODEV;
 789        rc = __tpm_pcr_read(chip, pcr_idx, res_buf);
 790        tpm_chip_put(chip);
 791        return rc;
 792}
 793EXPORT_SYMBOL_GPL(tpm_pcr_read);
 794
 795/**
 796 * tpm_pcr_extend - extend pcr value with hash
 797 * @chip_num:   tpm idx # or AN&
 798 * @pcr_idx:    pcr idx to extend
 799 * @hash:       hash value used to extend pcr value
 800 *
 801 * The TPM driver should be built-in, but for whatever reason it
 802 * isn't, protect against the chip disappearing, by incrementing
 803 * the module usage count.
 804 */
 805#define TPM_ORD_PCR_EXTEND cpu_to_be32(20)
 806#define EXTEND_PCR_RESULT_SIZE 34
 807static struct tpm_input_header pcrextend_header = {
 808        .tag = TPM_TAG_RQU_COMMAND,
 809        .length = cpu_to_be32(34),
 810        .ordinal = TPM_ORD_PCR_EXTEND
 811};
 812
 813int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
 814{
 815        struct tpm_cmd_t cmd;
 816        int rc;
 817        struct tpm_chip *chip;
 818
 819        chip = tpm_chip_find_get(chip_num);
 820        if (chip == NULL)
 821                return -ENODEV;
 822
 823        cmd.header.in = pcrextend_header;
 824        cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
 825        memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
 826        rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
 827                          "attempting extend a PCR value");
 828
 829        tpm_chip_put(chip);
 830        return rc;
 831}
 832EXPORT_SYMBOL_GPL(tpm_pcr_extend);
 833
 834/**
 835 * tpm_do_selftest - have the TPM continue its selftest and wait until it
 836 *                   can receive further commands
 837 * @chip: TPM chip to use
 838 *
 839 * Returns 0 on success, < 0 in case of fatal error or a value > 0 representing
 840 * a TPM error code.
 841 */
 842int tpm_do_selftest(struct tpm_chip *chip)
 843{
 844        int rc;
 845        unsigned int loops;
 846        unsigned int delay_msec = 100;
 847        unsigned long duration;
 848        struct tpm_cmd_t cmd;
 849
 850        duration = tpm_calc_ordinal_duration(chip,
 851                                             TPM_ORD_CONTINUE_SELFTEST);
 852
 853        loops = jiffies_to_msecs(duration) / delay_msec;
 854
 855        rc = tpm_continue_selftest(chip);
 856        /* This may fail if there was no TPM driver during a suspend/resume
 857         * cycle; some may return 10 (BAD_ORDINAL), others 28 (FAILEDSELFTEST)
 858         */
 859        if (rc)
 860                return rc;
 861
 862        do {
 863                /* Attempt to read a PCR value */
 864                cmd.header.in = pcrread_header;
 865                cmd.params.pcrread_in.pcr_idx = cpu_to_be32(0);
 866                rc = tpm_transmit(chip, (u8 *) &cmd, READ_PCR_RESULT_SIZE);
 867                /* Some buggy TPMs will not respond to tpm_tis_ready() for
 868                 * around 300ms while the self test is ongoing, keep trying
 869                 * until the self test duration expires. */
 870                if (rc == -ETIME) {
 871                        dev_info(chip->dev, HW_ERR "TPM command timed out during continue self test");
 872                        msleep(delay_msec);
 873                        continue;
 874                }
 875
 876                if (rc < TPM_HEADER_SIZE)
 877                        return -EFAULT;
 878
 879                rc = be32_to_cpu(cmd.header.out.return_code);
 880                if (rc == TPM_ERR_DISABLED || rc == TPM_ERR_DEACTIVATED) {
 881                        dev_info(chip->dev,
 882                                 "TPM is disabled/deactivated (0x%X)\n", rc);
 883                        /* TPM is disabled and/or deactivated; driver can
 884                         * proceed and TPM does handle commands for
 885                         * suspend/resume correctly
 886                         */
 887                        return 0;
 888                }
 889                if (rc != TPM_WARN_DOING_SELFTEST)
 890                        return rc;
 891                msleep(delay_msec);
 892        } while (--loops > 0);
 893
 894        return rc;
 895}
 896EXPORT_SYMBOL_GPL(tpm_do_selftest);
 897
 898int tpm_send(u32 chip_num, void *cmd, size_t buflen)
 899{
 900        struct tpm_chip *chip;
 901        int rc;
 902
 903        chip = tpm_chip_find_get(chip_num);
 904        if (chip == NULL)
 905                return -ENODEV;
 906
 907        rc = transmit_cmd(chip, cmd, buflen, "attempting tpm_cmd");
 908
 909        tpm_chip_put(chip);
 910        return rc;
 911}
 912EXPORT_SYMBOL_GPL(tpm_send);
 913
 914ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
 915                      char *buf)
 916{
 917        cap_t cap;
 918        u8 digest[TPM_DIGEST_SIZE];
 919        ssize_t rc;
 920        int i, j, num_pcrs;
 921        char *str = buf;
 922        struct tpm_chip *chip = dev_get_drvdata(dev);
 923
 924        rc = tpm_getcap(dev, TPM_CAP_PROP_PCR, &cap,
 925                        "attempting to determine the number of PCRS");
 926        if (rc)
 927                return 0;
 928
 929        num_pcrs = be32_to_cpu(cap.num_pcrs);
 930        for (i = 0; i < num_pcrs; i++) {
 931                rc = __tpm_pcr_read(chip, i, digest);
 932                if (rc)
 933                        break;
 934                str += sprintf(str, "PCR-%02d: ", i);
 935                for (j = 0; j < TPM_DIGEST_SIZE; j++)
 936                        str += sprintf(str, "%02X ", digest[j]);
 937                str += sprintf(str, "\n");
 938        }
 939        return str - buf;
 940}
 941EXPORT_SYMBOL_GPL(tpm_show_pcrs);
 942
 943#define  READ_PUBEK_RESULT_SIZE 314
 944#define TPM_ORD_READPUBEK cpu_to_be32(124)
 945static struct tpm_input_header tpm_readpubek_header = {
 946        .tag = TPM_TAG_RQU_COMMAND,
 947        .length = cpu_to_be32(30),
 948        .ordinal = TPM_ORD_READPUBEK
 949};
 950
 951ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 952                       char *buf)
 953{
 954        u8 *data;
 955        struct tpm_cmd_t tpm_cmd;
 956        ssize_t err;
 957        int i, rc;
 958        char *str = buf;
 959
 960        struct tpm_chip *chip = dev_get_drvdata(dev);
 961
 962        tpm_cmd.header.in = tpm_readpubek_header;
 963        err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
 964                        "attempting to read the PUBEK");
 965        if (err)
 966                goto out;
 967
 968        /* 
 969           ignore header 10 bytes
 970           algorithm 32 bits (1 == RSA )
 971           encscheme 16 bits
 972           sigscheme 16 bits
 973           parameters (RSA 12->bytes: keybit, #primes, expbit)  
 974           keylenbytes 32 bits
 975           256 byte modulus
 976           ignore checksum 20 bytes
 977         */
 978        data = tpm_cmd.params.readpubek_out_buffer;
 979        str +=
 980            sprintf(str,
 981                    "Algorithm: %02X %02X %02X %02X\n"
 982                    "Encscheme: %02X %02X\n"
 983                    "Sigscheme: %02X %02X\n"
 984                    "Parameters: %02X %02X %02X %02X "
 985                    "%02X %02X %02X %02X "
 986                    "%02X %02X %02X %02X\n"
 987                    "Modulus length: %d\n"
 988                    "Modulus:\n",
 989                    data[0], data[1], data[2], data[3],
 990                    data[4], data[5],
 991                    data[6], data[7],
 992                    data[12], data[13], data[14], data[15],
 993                    data[16], data[17], data[18], data[19],
 994                    data[20], data[21], data[22], data[23],
 995                    be32_to_cpu(*((__be32 *) (data + 24))));
 996
 997        for (i = 0; i < 256; i++) {
 998                str += sprintf(str, "%02X ", data[i + 28]);
 999                if ((i + 1) % 16 == 0)
1000                        str += sprintf(str, "\n");
1001        }
1002out:
1003        rc = str - buf;
1004        return rc;
1005}
1006EXPORT_SYMBOL_GPL(tpm_show_pubek);
1007
1008
1009ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
1010                      char *buf)
1011{
1012        cap_t cap;
1013        ssize_t rc;
1014        char *str = buf;
1015
1016        rc = tpm_getcap(dev, TPM_CAP_PROP_MANUFACTURER, &cap,
1017                        "attempting to determine the manufacturer");
1018        if (rc)
1019                return 0;
1020        str += sprintf(str, "Manufacturer: 0x%x\n",
1021                       be32_to_cpu(cap.manufacturer_id));
1022
1023        rc = tpm_getcap(dev, CAP_VERSION_1_1, &cap,
1024                        "attempting to determine the 1.1 version");
1025        if (rc)
1026                return 0;
1027        str += sprintf(str,
1028                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
1029                       cap.tpm_version.Major, cap.tpm_version.Minor,
1030                       cap.tpm_version.revMajor, cap.tpm_version.revMinor);
1031        return str - buf;
1032}
1033EXPORT_SYMBOL_GPL(tpm_show_caps);
1034
1035ssize_t tpm_show_caps_1_2(struct device * dev,
1036                          struct device_attribute * attr, char *buf)
1037{
1038        cap_t cap;
1039        ssize_t rc;
1040        char *str = buf;
1041
1042        rc = tpm_getcap(dev, TPM_CAP_PROP_MANUFACTURER, &cap,
1043                        "attempting to determine the manufacturer");
1044        if (rc)
1045                return 0;
1046        str += sprintf(str, "Manufacturer: 0x%x\n",
1047                       be32_to_cpu(cap.manufacturer_id));
1048        rc = tpm_getcap(dev, CAP_VERSION_1_2, &cap,
1049                         "attempting to determine the 1.2 version");
1050        if (rc)
1051                return 0;
1052        str += sprintf(str,
1053                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
1054                       cap.tpm_version_1_2.Major, cap.tpm_version_1_2.Minor,
1055                       cap.tpm_version_1_2.revMajor,
1056                       cap.tpm_version_1_2.revMinor);
1057        return str - buf;
1058}
1059EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
1060
1061ssize_t tpm_show_durations(struct device *dev, struct device_attribute *attr,
1062                          char *buf)
1063{
1064        struct tpm_chip *chip = dev_get_drvdata(dev);
1065
1066        if (chip->vendor.duration[TPM_LONG] == 0)
1067                return 0;
1068
1069        return sprintf(buf, "%d %d %d [%s]\n",
1070                       jiffies_to_usecs(chip->vendor.duration[TPM_SHORT]),
1071                       jiffies_to_usecs(chip->vendor.duration[TPM_MEDIUM]),
1072                       jiffies_to_usecs(chip->vendor.duration[TPM_LONG]),
1073                       chip->vendor.duration_adjusted
1074                       ? "adjusted" : "original");
1075}
1076EXPORT_SYMBOL_GPL(tpm_show_durations);
1077
1078ssize_t tpm_show_timeouts(struct device *dev, struct device_attribute *attr,
1079                          char *buf)
1080{
1081        struct tpm_chip *chip = dev_get_drvdata(dev);
1082
1083        return sprintf(buf, "%d %d %d %d [%s]\n",
1084                       jiffies_to_usecs(chip->vendor.timeout_a),
1085                       jiffies_to_usecs(chip->vendor.timeout_b),
1086                       jiffies_to_usecs(chip->vendor.timeout_c),
1087                       jiffies_to_usecs(chip->vendor.timeout_d),
1088                       chip->vendor.timeout_adjusted
1089                       ? "adjusted" : "original");
1090}
1091EXPORT_SYMBOL_GPL(tpm_show_timeouts);
1092
1093ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
1094                        const char *buf, size_t count)
1095{
1096        struct tpm_chip *chip = dev_get_drvdata(dev);
1097        if (chip == NULL)
1098                return 0;
1099
1100        chip->vendor.cancel(chip);
1101        return count;
1102}
1103EXPORT_SYMBOL_GPL(tpm_store_cancel);
1104
1105static bool wait_for_tpm_stat_cond(struct tpm_chip *chip, u8 mask, bool check_cancel,
1106                                   bool *canceled)
1107{
1108        u8 status = chip->vendor.status(chip);
1109
1110        *canceled = false;
1111        if ((status & mask) == mask)
1112                return true;
1113        if (check_cancel && chip->vendor.req_canceled(chip, status)) {
1114                *canceled = true;
1115                return true;
1116        }
1117        return false;
1118}
1119
1120int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
1121                      wait_queue_head_t *queue, bool check_cancel)
1122{
1123        unsigned long stop;
1124        long rc;
1125        u8 status;
1126        bool canceled = false;
1127
1128        /* check current status */
1129        status = chip->vendor.status(chip);
1130        if ((status & mask) == mask)
1131                return 0;
1132
1133        stop = jiffies + timeout;
1134
1135        if (chip->vendor.irq) {
1136again:
1137                timeout = stop - jiffies;
1138                if ((long)timeout <= 0)
1139                        return -ETIME;
1140                rc = wait_event_interruptible_timeout(*queue,
1141                        wait_for_tpm_stat_cond(chip, mask, check_cancel,
1142                                               &canceled),
1143                        timeout);
1144                if (rc > 0) {
1145                        if (canceled)
1146                                return -ECANCELED;
1147                        return 0;
1148                }
1149                if (rc == -ERESTARTSYS && freezing(current)) {
1150                        clear_thread_flag(TIF_SIGPENDING);
1151                        goto again;
1152                }
1153        } else {
1154                do {
1155                        msleep(TPM_TIMEOUT);
1156                        status = chip->vendor.status(chip);
1157                        if ((status & mask) == mask)
1158                                return 0;
1159                } while (time_before(jiffies, stop));
1160        }
1161        return -ETIME;
1162}
1163EXPORT_SYMBOL_GPL(wait_for_tpm_stat);
1164/*
1165 * Device file system interface to the TPM
1166 *
1167 * It's assured that the chip will be opened just once,
1168 * by the check of is_open variable, which is protected
1169 * by driver_lock.
1170 */
1171int tpm_open(struct inode *inode, struct file *file)
1172{
1173        int minor = iminor(inode);
1174        struct tpm_chip *chip = NULL, *pos;
1175
1176        rcu_read_lock();
1177        list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
1178                if (pos->vendor.miscdev.minor == minor) {
1179                        chip = pos;
1180                        get_device(chip->dev);
1181                        break;
1182                }
1183        }
1184        rcu_read_unlock();
1185
1186        if (!chip)
1187                return -ENODEV;
1188
1189        if (test_and_set_bit(0, &chip->is_open)) {
1190                dev_dbg(chip->dev, "Another process owns this TPM\n");
1191                put_device(chip->dev);
1192                return -EBUSY;
1193        }
1194
1195        chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
1196        if (chip->data_buffer == NULL) {
1197                clear_bit(0, &chip->is_open);
1198                put_device(chip->dev);
1199                return -ENOMEM;
1200        }
1201
1202        atomic_set(&chip->data_pending, 0);
1203
1204        file->private_data = chip;
1205        return 0;
1206}
1207EXPORT_SYMBOL_GPL(tpm_open);
1208
1209/*
1210 * Called on file close
1211 */
1212int tpm_release(struct inode *inode, struct file *file)
1213{
1214        struct tpm_chip *chip = file->private_data;
1215
1216        del_singleshot_timer_sync(&chip->user_read_timer);
1217        flush_work(&chip->work);
1218        file->private_data = NULL;
1219        atomic_set(&chip->data_pending, 0);
1220        kzfree(chip->data_buffer);
1221        clear_bit(0, &chip->is_open);
1222        put_device(chip->dev);
1223        return 0;
1224}
1225EXPORT_SYMBOL_GPL(tpm_release);
1226
1227ssize_t tpm_write(struct file *file, const char __user *buf,
1228                  size_t size, loff_t *off)
1229{
1230        struct tpm_chip *chip = file->private_data;
1231        size_t in_size = size;
1232        ssize_t out_size;
1233
1234        /* cannot perform a write until the read has cleared
1235           either via tpm_read or a user_read_timer timeout.
1236           This also prevents splitted buffered writes from blocking here.
1237        */
1238        if (atomic_read(&chip->data_pending) != 0)
1239                return -EBUSY;
1240
1241        if (in_size > TPM_BUFSIZE)
1242                return -E2BIG;
1243
1244        mutex_lock(&chip->buffer_mutex);
1245
1246        if (copy_from_user
1247            (chip->data_buffer, (void __user *) buf, in_size)) {
1248                mutex_unlock(&chip->buffer_mutex);
1249                return -EFAULT;
1250        }
1251
1252        /* atomic tpm command send and result receive */
1253        out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
1254        if (out_size < 0) {
1255                mutex_unlock(&chip->buffer_mutex);
1256                return out_size;
1257        }
1258
1259        atomic_set(&chip->data_pending, out_size);
1260        mutex_unlock(&chip->buffer_mutex);
1261
1262        /* Set a timeout by which the reader must come claim the result */
1263        mod_timer(&chip->user_read_timer, jiffies + (60 * HZ));
1264
1265        return in_size;
1266}
1267EXPORT_SYMBOL_GPL(tpm_write);
1268
1269ssize_t tpm_read(struct file *file, char __user *buf,
1270                 size_t size, loff_t *off)
1271{
1272        struct tpm_chip *chip = file->private_data;
1273        ssize_t ret_size;
1274        int rc;
1275
1276        del_singleshot_timer_sync(&chip->user_read_timer);
1277        flush_work(&chip->work);
1278        ret_size = atomic_read(&chip->data_pending);
1279        if (ret_size > 0) {     /* relay data */
1280                ssize_t orig_ret_size = ret_size;
1281                if (size < ret_size)
1282                        ret_size = size;
1283
1284                mutex_lock(&chip->buffer_mutex);
1285                rc = copy_to_user(buf, chip->data_buffer, ret_size);
1286                memset(chip->data_buffer, 0, orig_ret_size);
1287                if (rc)
1288                        ret_size = -EFAULT;
1289
1290                mutex_unlock(&chip->buffer_mutex);
1291        }
1292
1293        atomic_set(&chip->data_pending, 0);
1294
1295        return ret_size;
1296}
1297EXPORT_SYMBOL_GPL(tpm_read);
1298
1299void tpm_remove_hardware(struct device *dev)
1300{
1301        struct tpm_chip *chip = dev_get_drvdata(dev);
1302
1303        if (chip == NULL) {
1304                dev_err(dev, "No device data found\n");
1305                return;
1306        }
1307
1308        spin_lock(&driver_lock);
1309        list_del_rcu(&chip->list);
1310        spin_unlock(&driver_lock);
1311        synchronize_rcu();
1312
1313        misc_deregister(&chip->vendor.miscdev);
1314        sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
1315        tpm_remove_ppi(&dev->kobj);
1316        tpm_bios_log_teardown(chip->bios_dir);
1317
1318        /* write it this way to be explicit (chip->dev == dev) */
1319        put_device(chip->dev);
1320}
1321EXPORT_SYMBOL_GPL(tpm_remove_hardware);
1322
1323#define TPM_ORD_SAVESTATE cpu_to_be32(152)
1324#define SAVESTATE_RESULT_SIZE 10
1325
1326static struct tpm_input_header savestate_header = {
1327        .tag = TPM_TAG_RQU_COMMAND,
1328        .length = cpu_to_be32(10),
1329        .ordinal = TPM_ORD_SAVESTATE
1330};
1331
1332/*
1333 * We are about to suspend. Save the TPM state
1334 * so that it can be restored.
1335 */
1336int tpm_pm_suspend(struct device *dev)
1337{
1338        struct tpm_chip *chip = dev_get_drvdata(dev);
1339        struct tpm_cmd_t cmd;
1340        int rc, try;
1341
1342        u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
1343
1344        if (chip == NULL)
1345                return -ENODEV;
1346
1347        /* for buggy tpm, flush pcrs with extend to selected dummy */
1348        if (tpm_suspend_pcr) {
1349                cmd.header.in = pcrextend_header;
1350                cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);
1351                memcpy(cmd.params.pcrextend_in.hash, dummy_hash,
1352                       TPM_DIGEST_SIZE);
1353                rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
1354                                  "extending dummy pcr before suspend");
1355        }
1356
1357        /* now do the actual savestate */
1358        for (try = 0; try < TPM_RETRY; try++) {
1359                cmd.header.in = savestate_header;
1360                rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);
1361
1362                /*
1363                 * If the TPM indicates that it is too busy to respond to
1364                 * this command then retry before giving up.  It can take
1365                 * several seconds for this TPM to be ready.
1366                 *
1367                 * This can happen if the TPM has already been sent the
1368                 * SaveState command before the driver has loaded.  TCG 1.2
1369                 * specification states that any communication after SaveState
1370                 * may cause the TPM to invalidate previously saved state.
1371                 */
1372                if (rc != TPM_WARN_RETRY)
1373                        break;
1374                msleep(TPM_TIMEOUT_RETRY);
1375        }
1376
1377        if (rc)
1378                dev_err(chip->dev,
1379                        "Error (%d) sending savestate before suspend\n", rc);
1380        else if (try > 0)
1381                dev_warn(chip->dev, "TPM savestate took %dms\n",
1382                         try * TPM_TIMEOUT_RETRY);
1383
1384        return rc;
1385}
1386EXPORT_SYMBOL_GPL(tpm_pm_suspend);
1387
1388/*
1389 * Resume from a power safe. The BIOS already restored
1390 * the TPM state.
1391 */
1392int tpm_pm_resume(struct device *dev)
1393{
1394        struct tpm_chip *chip = dev_get_drvdata(dev);
1395
1396        if (chip == NULL)
1397                return -ENODEV;
1398
1399        return 0;
1400}
1401EXPORT_SYMBOL_GPL(tpm_pm_resume);
1402
1403#define TPM_GETRANDOM_RESULT_SIZE       18
1404static struct tpm_input_header tpm_getrandom_header = {
1405        .tag = TPM_TAG_RQU_COMMAND,
1406        .length = cpu_to_be32(14),
1407        .ordinal = TPM_ORD_GET_RANDOM
1408};
1409
1410/**
1411 * tpm_get_random() - Get random bytes from the tpm's RNG
1412 * @chip_num: A specific chip number for the request or TPM_ANY_NUM
1413 * @out: destination buffer for the random bytes
1414 * @max: the max number of bytes to write to @out
1415 *
1416 * Returns < 0 on error and the number of bytes read on success
1417 */
1418int tpm_get_random(u32 chip_num, u8 *out, size_t max)
1419{
1420        struct tpm_chip *chip;
1421        struct tpm_cmd_t tpm_cmd;
1422        u32 recd, num_bytes = min_t(u32, max, TPM_MAX_RNG_DATA);
1423        int err, total = 0, retries = 5;
1424        u8 *dest = out;
1425
1426        chip = tpm_chip_find_get(chip_num);
1427        if (chip == NULL)
1428                return -ENODEV;
1429
1430        if (!out || !num_bytes || max > TPM_MAX_RNG_DATA)
1431                return -EINVAL;
1432
1433        do {
1434                tpm_cmd.header.in = tpm_getrandom_header;
1435                tpm_cmd.params.getrandom_in.num_bytes = cpu_to_be32(num_bytes);
1436
1437                err = transmit_cmd(chip, &tpm_cmd,
1438                                   TPM_GETRANDOM_RESULT_SIZE + num_bytes,
1439                                   "attempting get random");
1440                if (err)
1441                        break;
1442
1443                recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len);
1444                memcpy(dest, tpm_cmd.params.getrandom_out.rng_data, recd);
1445
1446                dest += recd;
1447                total += recd;
1448                num_bytes -= recd;
1449        } while (retries-- && total < max);
1450
1451        return total ? total : -EIO;
1452}
1453EXPORT_SYMBOL_GPL(tpm_get_random);
1454
1455/* In case vendor provided release function, call it too.*/
1456
1457void tpm_dev_vendor_release(struct tpm_chip *chip)
1458{
1459        if (!chip)
1460                return;
1461
1462        if (chip->vendor.release)
1463                chip->vendor.release(chip->dev);
1464
1465        clear_bit(chip->dev_num, dev_mask);
1466        kfree(chip->vendor.miscdev.name);
1467}
1468EXPORT_SYMBOL_GPL(tpm_dev_vendor_release);
1469
1470
1471/*
1472 * Once all references to platform device are down to 0,
1473 * release all allocated structures.
1474 */
1475void tpm_dev_release(struct device *dev)
1476{
1477        struct tpm_chip *chip = dev_get_drvdata(dev);
1478
1479        if (!chip)
1480                return;
1481
1482        tpm_dev_vendor_release(chip);
1483
1484        chip->release(dev);
1485        kfree(chip);
1486}
1487EXPORT_SYMBOL_GPL(tpm_dev_release);
1488
1489/*
1490 * Called from tpm_<specific>.c probe function only for devices 
1491 * the driver has determined it should claim.  Prior to calling
1492 * this function the specific probe function has called pci_enable_device
1493 * upon errant exit from this function specific probe function should call
1494 * pci_disable_device
1495 */
1496struct tpm_chip *tpm_register_hardware(struct device *dev,
1497                                        const struct tpm_vendor_specific *entry)
1498{
1499#define DEVNAME_SIZE 7
1500
1501        char *devname;
1502        struct tpm_chip *chip;
1503
1504        /* Driver specific per-device data */
1505        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
1506        devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
1507
1508        if (chip == NULL || devname == NULL)
1509                goto out_free;
1510
1511        mutex_init(&chip->buffer_mutex);
1512        mutex_init(&chip->tpm_mutex);
1513        INIT_LIST_HEAD(&chip->list);
1514
1515        INIT_WORK(&chip->work, timeout_work);
1516
1517        setup_timer(&chip->user_read_timer, user_reader_timeout,
1518                        (unsigned long)chip);
1519
1520        memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
1521
1522        chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
1523
1524        if (chip->dev_num >= TPM_NUM_DEVICES) {
1525                dev_err(dev, "No available tpm device numbers\n");
1526                goto out_free;
1527        } else if (chip->dev_num == 0)
1528                chip->vendor.miscdev.minor = TPM_MINOR;
1529        else
1530                chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
1531
1532        set_bit(chip->dev_num, dev_mask);
1533
1534        scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
1535        chip->vendor.miscdev.name = devname;
1536
1537        chip->vendor.miscdev.parent = dev;
1538        chip->dev = get_device(dev);
1539        chip->release = dev->release;
1540        dev->release = tpm_dev_release;
1541        dev_set_drvdata(dev, chip);
1542
1543        if (misc_register(&chip->vendor.miscdev)) {
1544                dev_err(chip->dev,
1545                        "unable to misc_register %s, minor %d\n",
1546                        chip->vendor.miscdev.name,
1547                        chip->vendor.miscdev.minor);
1548                goto put_device;
1549        }
1550
1551        if (sysfs_create_group(&dev->kobj, chip->vendor.attr_group)) {
1552                misc_deregister(&chip->vendor.miscdev);
1553                goto put_device;
1554        }
1555
1556        if (tpm_add_ppi(&dev->kobj)) {
1557                misc_deregister(&chip->vendor.miscdev);
1558                goto put_device;
1559        }
1560
1561        chip->bios_dir = tpm_bios_log_setup(devname);
1562
1563        /* Make chip available */
1564        spin_lock(&driver_lock);
1565        list_add_rcu(&chip->list, &tpm_chip_list);
1566        spin_unlock(&driver_lock);
1567
1568        return chip;
1569
1570put_device:
1571        put_device(chip->dev);
1572out_free:
1573        kfree(chip);
1574        kfree(devname);
1575        return NULL;
1576}
1577EXPORT_SYMBOL_GPL(tpm_register_hardware);
1578
1579MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
1580MODULE_DESCRIPTION("TPM Driver");
1581MODULE_VERSION("2.0");
1582MODULE_LICENSE("GPL");
1583