1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Author:
4 * Miquel Raynal <miquel.raynal@bootlin.com>
5 *
6 * Description:
7 * SPI-level driver for TCG/TIS TPM (trusted platform module).
8 * Specifications at www.trustedcomputinggroup.org
9 *
10 * This device driver implements the TPM interface as defined in
11 * the TCG SPI protocol stack version 2.0.
12 *
13 * It is based on the U-Boot driver tpm_tis_infineon_i2c.c.
14 */
15
16 #include <common.h>
17 #include <dm.h>
18 #include <fdtdec.h>
19 #include <log.h>
20 #include <spi.h>
21 #include <tpm-v2.h>
22 #include <linux/errno.h>
23 #include <linux/compiler.h>
24 #include <linux/types.h>
25 #include <linux/unaligned/be_byteshift.h>
26 #include <asm-generic/gpio.h>
27
28 #include "tpm_tis.h"
29 #include "tpm_internal.h"
30
31 DECLARE_GLOBAL_DATA_PTR;
32
33 #define TPM_ACCESS(l) (0x0000 | ((l) << 12))
34 #define TPM_INT_ENABLE(l) (0x0008 | ((l) << 12))
35 #define TPM_STS(l) (0x0018 | ((l) << 12))
36 #define TPM_DATA_FIFO(l) (0x0024 | ((l) << 12))
37 #define TPM_DID_VID(l) (0x0F00 | ((l) << 12))
38 #define TPM_RID(l) (0x0F04 | ((l) << 12))
39
40 #define MAX_SPI_FRAMESIZE 64
41
42 /* Number of wait states to wait for */
43 #define TPM_WAIT_STATES 100
44
45 /**
46 * struct tpm_tis_chip_data - Non-discoverable TPM information
47 *
48 * @pcr_count: Number of PCR per bank
49 * @pcr_select_min: Size in octets of the pcrSelect array
50 */
51 struct tpm_tis_chip_data {
52 unsigned int pcr_count;
53 unsigned int pcr_select_min;
54 unsigned int time_before_first_cmd_ms;
55 };
56
57 /**
58 * tpm_tis_spi_read() - Read from TPM register
59 *
60 * @addr: register address to read from
61 * @buffer: provided by caller
62 * @len: number of bytes to read
63 *
64 * Read len bytes from TPM register and put them into
65 * buffer (little-endian format, i.e. first byte is put into buffer[0]).
66 *
67 * NOTE: TPM is big-endian for multi-byte values. Multi-byte
68 * values have to be swapped.
69 *
70 * @return -EIO on error, 0 on success.
71 */
tpm_tis_spi_xfer(struct udevice * dev,u32 addr,const u8 * out,u8 * in,u16 len)72 static int tpm_tis_spi_xfer(struct udevice *dev, u32 addr, const u8 *out,
73 u8 *in, u16 len)
74 {
75 struct spi_slave *slave = dev_get_parent_priv(dev);
76 int transfer_len, ret;
77 u8 tx_buf[MAX_SPI_FRAMESIZE];
78 u8 rx_buf[MAX_SPI_FRAMESIZE];
79
80 if (in && out) {
81 log(LOGC_NONE, LOGL_ERR, "%s: can't do full duplex\n",
82 __func__);
83 return -EINVAL;
84 }
85
86 ret = spi_claim_bus(slave);
87 if (ret < 0) {
88 log(LOGC_NONE, LOGL_ERR, "%s: could not claim bus\n", __func__);
89 return ret;
90 }
91
92 while (len) {
93 /* Request */
94 transfer_len = min_t(u16, len, MAX_SPI_FRAMESIZE);
95 tx_buf[0] = (in ? BIT(7) : 0) | (transfer_len - 1);
96 tx_buf[1] = 0xD4;
97 tx_buf[2] = addr >> 8;
98 tx_buf[3] = addr;
99
100 ret = spi_xfer(slave, 4 * 8, tx_buf, rx_buf, SPI_XFER_BEGIN);
101 if (ret < 0) {
102 log(LOGC_NONE, LOGL_ERR,
103 "%s: spi request transfer failed (err: %d)\n",
104 __func__, ret);
105 goto release_bus;
106 }
107
108 /* Wait state */
109 if (!(rx_buf[3] & 0x1)) {
110 int i;
111
112 for (i = 0; i < TPM_WAIT_STATES; i++) {
113 ret = spi_xfer(slave, 1 * 8, NULL, rx_buf, 0);
114 if (ret) {
115 log(LOGC_NONE, LOGL_ERR,
116 "%s: wait state failed: %d\n",
117 __func__, ret);
118 goto release_bus;
119 }
120
121 if (rx_buf[0] & 0x1)
122 break;
123 }
124
125 if (i == TPM_WAIT_STATES) {
126 log(LOGC_NONE, LOGL_ERR,
127 "%s: timeout on wait state\n", __func__);
128 ret = -ETIMEDOUT;
129 goto release_bus;
130 }
131 }
132
133 /* Read/Write */
134 if (out) {
135 memcpy(tx_buf, out, transfer_len);
136 out += transfer_len;
137 }
138
139 ret = spi_xfer(slave, transfer_len * 8,
140 out ? tx_buf : NULL,
141 in ? rx_buf : NULL,
142 SPI_XFER_END);
143 if (ret) {
144 log(LOGC_NONE, LOGL_ERR,
145 "%s: spi read transfer failed (err: %d)\n",
146 __func__, ret);
147 goto release_bus;
148 }
149
150 if (in) {
151 memcpy(in, rx_buf, transfer_len);
152 in += transfer_len;
153 }
154
155 len -= transfer_len;
156 }
157
158 release_bus:
159 /* If an error occurred, release the chip by deasserting the CS */
160 if (ret < 0)
161 spi_xfer(slave, 0, NULL, NULL, SPI_XFER_END);
162
163 spi_release_bus(slave);
164
165 return ret;
166 }
167
tpm_tis_spi_read(struct udevice * dev,u16 addr,u8 * in,u16 len)168 static int tpm_tis_spi_read(struct udevice *dev, u16 addr, u8 *in, u16 len)
169 {
170 return tpm_tis_spi_xfer(dev, addr, NULL, in, len);
171 }
172
tpm_tis_spi_read32(struct udevice * dev,u32 addr,u32 * result)173 static int tpm_tis_spi_read32(struct udevice *dev, u32 addr, u32 *result)
174 {
175 __le32 result_le;
176 int ret;
177
178 ret = tpm_tis_spi_read(dev, addr, (u8 *)&result_le, sizeof(u32));
179 if (!ret)
180 *result = le32_to_cpu(result_le);
181
182 return ret;
183 }
184
tpm_tis_spi_write(struct udevice * dev,u16 addr,const u8 * out,u16 len)185 static int tpm_tis_spi_write(struct udevice *dev, u16 addr, const u8 *out,
186 u16 len)
187 {
188 return tpm_tis_spi_xfer(dev, addr, out, NULL, len);
189 }
190
tpm_tis_spi_check_locality(struct udevice * dev,int loc)191 static int tpm_tis_spi_check_locality(struct udevice *dev, int loc)
192 {
193 const u8 mask = TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID;
194 struct tpm_chip *chip = dev_get_priv(dev);
195 u8 buf;
196 int ret;
197
198 ret = tpm_tis_spi_read(dev, TPM_ACCESS(loc), &buf, 1);
199 if (ret)
200 return ret;
201
202 if ((buf & mask) == mask) {
203 chip->locality = loc;
204 return 0;
205 }
206
207 return -ENOENT;
208 }
209
tpm_tis_spi_release_locality(struct udevice * dev,int loc,bool force)210 static void tpm_tis_spi_release_locality(struct udevice *dev, int loc,
211 bool force)
212 {
213 const u8 mask = TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID;
214 u8 buf;
215
216 if (tpm_tis_spi_read(dev, TPM_ACCESS(loc), &buf, 1) < 0)
217 return;
218
219 if (force || (buf & mask) == mask) {
220 buf = TPM_ACCESS_ACTIVE_LOCALITY;
221 tpm_tis_spi_write(dev, TPM_ACCESS(loc), &buf, 1);
222 }
223 }
224
tpm_tis_spi_request_locality(struct udevice * dev,int loc)225 static int tpm_tis_spi_request_locality(struct udevice *dev, int loc)
226 {
227 struct tpm_chip *chip = dev_get_priv(dev);
228 unsigned long start, stop;
229 u8 buf = TPM_ACCESS_REQUEST_USE;
230 int ret;
231
232 ret = tpm_tis_spi_check_locality(dev, loc);
233 if (!ret)
234 return 0;
235
236 if (ret != -ENOENT) {
237 log(LOGC_NONE, LOGL_ERR, "%s: Failed to get locality: %d\n",
238 __func__, ret);
239 return ret;
240 }
241
242 ret = tpm_tis_spi_write(dev, TPM_ACCESS(loc), &buf, 1);
243 if (ret) {
244 log(LOGC_NONE, LOGL_ERR, "%s: Failed to write to TPM: %d\n",
245 __func__, ret);
246 return ret;
247 }
248
249 start = get_timer(0);
250 stop = chip->timeout_a;
251 do {
252 ret = tpm_tis_spi_check_locality(dev, loc);
253 if (!ret)
254 return 0;
255
256 if (ret != -ENOENT) {
257 log(LOGC_NONE, LOGL_ERR,
258 "%s: Failed to get locality: %d\n", __func__, ret);
259 return ret;
260 }
261
262 mdelay(TPM_TIMEOUT_MS);
263 } while (get_timer(start) < stop);
264
265 log(LOGC_NONE, LOGL_ERR, "%s: Timeout getting locality: %d\n", __func__,
266 ret);
267
268 return ret;
269 }
270
tpm_tis_spi_status(struct udevice * dev,u8 * status)271 static u8 tpm_tis_spi_status(struct udevice *dev, u8 *status)
272 {
273 struct tpm_chip *chip = dev_get_priv(dev);
274
275 return tpm_tis_spi_read(dev, TPM_STS(chip->locality), status, 1);
276 }
277
tpm_tis_spi_wait_for_stat(struct udevice * dev,u8 mask,unsigned long timeout,u8 * status)278 static int tpm_tis_spi_wait_for_stat(struct udevice *dev, u8 mask,
279 unsigned long timeout, u8 *status)
280 {
281 unsigned long start = get_timer(0);
282 unsigned long stop = timeout;
283 int ret;
284
285 do {
286 mdelay(TPM_TIMEOUT_MS);
287 ret = tpm_tis_spi_status(dev, status);
288 if (ret)
289 return ret;
290
291 if ((*status & mask) == mask)
292 return 0;
293 } while (get_timer(start) < stop);
294
295 return -ETIMEDOUT;
296 }
297
tpm_tis_spi_get_burstcount(struct udevice * dev)298 static int tpm_tis_spi_get_burstcount(struct udevice *dev)
299 {
300 struct tpm_chip *chip = dev_get_priv(dev);
301 unsigned long start, stop;
302 u32 burstcount, ret;
303
304 /* wait for burstcount */
305 start = get_timer(0);
306 stop = chip->timeout_d;
307 do {
308 ret = tpm_tis_spi_read32(dev, TPM_STS(chip->locality),
309 &burstcount);
310 if (ret)
311 return -EBUSY;
312
313 burstcount = (burstcount >> 8) & 0xFFFF;
314 if (burstcount)
315 return burstcount;
316
317 mdelay(TPM_TIMEOUT_MS);
318 } while (get_timer(start) < stop);
319
320 return -EBUSY;
321 }
322
tpm_tis_spi_cancel(struct udevice * dev)323 static int tpm_tis_spi_cancel(struct udevice *dev)
324 {
325 struct tpm_chip *chip = dev_get_priv(dev);
326 u8 data = TPM_STS_COMMAND_READY;
327
328 return tpm_tis_spi_write(dev, TPM_STS(chip->locality), &data, 1);
329 }
330
tpm_tis_spi_recv_data(struct udevice * dev,u8 * buf,size_t count)331 static int tpm_tis_spi_recv_data(struct udevice *dev, u8 *buf, size_t count)
332 {
333 struct tpm_chip *chip = dev_get_priv(dev);
334 int size = 0, burstcnt, len, ret;
335 u8 status;
336
337 while (size < count &&
338 tpm_tis_spi_wait_for_stat(dev,
339 TPM_STS_DATA_AVAIL | TPM_STS_VALID,
340 chip->timeout_c, &status) == 0) {
341 burstcnt = tpm_tis_spi_get_burstcount(dev);
342 if (burstcnt < 0)
343 return burstcnt;
344
345 len = min_t(int, burstcnt, count - size);
346 ret = tpm_tis_spi_read(dev, TPM_DATA_FIFO(chip->locality),
347 buf + size, len);
348 if (ret < 0)
349 return ret;
350
351 size += len;
352 }
353
354 return size;
355 }
356
tpm_tis_spi_recv(struct udevice * dev,u8 * buf,size_t count)357 static int tpm_tis_spi_recv(struct udevice *dev, u8 *buf, size_t count)
358 {
359 struct tpm_chip *chip = dev_get_priv(dev);
360 int size, expected;
361
362 if (!chip)
363 return -ENODEV;
364
365 if (count < TPM_HEADER_SIZE) {
366 size = -EIO;
367 goto out;
368 }
369
370 size = tpm_tis_spi_recv_data(dev, buf, TPM_HEADER_SIZE);
371 if (size < TPM_HEADER_SIZE) {
372 log(LOGC_NONE, LOGL_ERR, "TPM error, unable to read header\n");
373 goto out;
374 }
375
376 expected = get_unaligned_be32(buf + 2);
377 if (expected > count) {
378 size = -EIO;
379 goto out;
380 }
381
382 size += tpm_tis_spi_recv_data(dev, &buf[TPM_HEADER_SIZE],
383 expected - TPM_HEADER_SIZE);
384 if (size < expected) {
385 log(LOGC_NONE, LOGL_ERR,
386 "TPM error, unable to read remaining bytes of result\n");
387 size = -EIO;
388 goto out;
389 }
390
391 out:
392 tpm_tis_spi_cancel(dev);
393 tpm_tis_spi_release_locality(dev, chip->locality, false);
394
395 return size;
396 }
397
tpm_tis_spi_send(struct udevice * dev,const u8 * buf,size_t len)398 static int tpm_tis_spi_send(struct udevice *dev, const u8 *buf, size_t len)
399 {
400 struct tpm_chip *chip = dev_get_priv(dev);
401 u32 i, size;
402 u8 status;
403 int burstcnt, ret;
404 u8 data;
405
406 if (!chip)
407 return -ENODEV;
408
409 if (len > TPM_DEV_BUFSIZE)
410 return -E2BIG; /* Command is too long for our tpm, sorry */
411
412 ret = tpm_tis_spi_request_locality(dev, 0);
413 if (ret < 0)
414 return -EBUSY;
415
416 /*
417 * Check if the TPM is ready. If not, if not, cancel the pending command
418 * and poll on the status to be finally ready.
419 */
420 ret = tpm_tis_spi_status(dev, &status);
421 if (ret)
422 return ret;
423
424 if (!(status & TPM_STS_COMMAND_READY)) {
425 /* Force the transition, usually this will be done at startup */
426 ret = tpm_tis_spi_cancel(dev);
427 if (ret) {
428 log(LOGC_NONE, LOGL_ERR,
429 "%s: Could not cancel previous operation\n",
430 __func__);
431 goto out_err;
432 }
433
434 ret = tpm_tis_spi_wait_for_stat(dev, TPM_STS_COMMAND_READY,
435 chip->timeout_b, &status);
436 if (ret < 0 || !(status & TPM_STS_COMMAND_READY)) {
437 log(LOGC_NONE, LOGL_ERR,
438 "status %d after wait for stat returned %d\n",
439 status, ret);
440 goto out_err;
441 }
442 }
443
444 for (i = 0; i < len - 1;) {
445 burstcnt = tpm_tis_spi_get_burstcount(dev);
446 if (burstcnt < 0)
447 return burstcnt;
448
449 size = min_t(int, len - i - 1, burstcnt);
450 ret = tpm_tis_spi_write(dev, TPM_DATA_FIFO(chip->locality),
451 buf + i, size);
452 if (ret < 0)
453 goto out_err;
454
455 i += size;
456 }
457
458 ret = tpm_tis_spi_status(dev, &status);
459 if (ret)
460 goto out_err;
461
462 if ((status & TPM_STS_DATA_EXPECT) == 0) {
463 ret = -EIO;
464 goto out_err;
465 }
466
467 ret = tpm_tis_spi_write(dev, TPM_DATA_FIFO(chip->locality),
468 buf + len - 1, 1);
469 if (ret)
470 goto out_err;
471
472 ret = tpm_tis_spi_status(dev, &status);
473 if (ret)
474 goto out_err;
475
476 if ((status & TPM_STS_DATA_EXPECT) != 0) {
477 ret = -EIO;
478 goto out_err;
479 }
480
481 data = TPM_STS_GO;
482 ret = tpm_tis_spi_write(dev, TPM_STS(chip->locality), &data, 1);
483 if (ret)
484 goto out_err;
485
486 return len;
487
488 out_err:
489 tpm_tis_spi_cancel(dev);
490 tpm_tis_spi_release_locality(dev, chip->locality, false);
491
492 return ret;
493 }
494
tpm_tis_spi_cleanup(struct udevice * dev)495 static int tpm_tis_spi_cleanup(struct udevice *dev)
496 {
497 struct tpm_chip *chip = dev_get_priv(dev);
498
499 tpm_tis_spi_cancel(dev);
500 /*
501 * The TPM needs some time to clean up here,
502 * so we sleep rather than keeping the bus busy
503 */
504 mdelay(2);
505 tpm_tis_spi_release_locality(dev, chip->locality, false);
506
507 return 0;
508 }
509
tpm_tis_spi_open(struct udevice * dev)510 static int tpm_tis_spi_open(struct udevice *dev)
511 {
512 struct tpm_chip *chip = dev_get_priv(dev);
513 struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
514
515 if (chip->is_open)
516 return -EBUSY;
517
518 chip->is_open = 1;
519
520 return 0;
521 }
522
tpm_tis_spi_close(struct udevice * dev)523 static int tpm_tis_spi_close(struct udevice *dev)
524 {
525 struct tpm_chip *chip = dev_get_priv(dev);
526
527 if (chip->is_open) {
528 tpm_tis_spi_release_locality(dev, chip->locality, true);
529 chip->is_open = 0;
530 }
531
532 return 0;
533 }
534
tpm_tis_get_desc(struct udevice * dev,char * buf,int size)535 static int tpm_tis_get_desc(struct udevice *dev, char *buf, int size)
536 {
537 struct tpm_chip *chip = dev_get_priv(dev);
538
539 if (size < 80)
540 return -ENOSPC;
541
542 return snprintf(buf, size,
543 "%s v2.0: VendorID 0x%04x, DeviceID 0x%04x, RevisionID 0x%02x [%s]",
544 dev->name, chip->vend_dev & 0xFFFF,
545 chip->vend_dev >> 16, chip->rid,
546 (chip->is_open ? "open" : "closed"));
547 }
548
tpm_tis_wait_init(struct udevice * dev,int loc)549 static int tpm_tis_wait_init(struct udevice *dev, int loc)
550 {
551 struct tpm_chip *chip = dev_get_priv(dev);
552 unsigned long start, stop;
553 u8 status;
554 int ret;
555
556 start = get_timer(0);
557 stop = chip->timeout_b;
558 do {
559 mdelay(TPM_TIMEOUT_MS);
560
561 ret = tpm_tis_spi_read(dev, TPM_ACCESS(loc), &status, 1);
562 if (ret)
563 break;
564
565 if (status & TPM_ACCESS_VALID)
566 return 0;
567 } while (get_timer(start) < stop);
568
569 return -EIO;
570 }
571
tpm_tis_spi_probe(struct udevice * dev)572 static int tpm_tis_spi_probe(struct udevice *dev)
573 {
574 struct tpm_tis_chip_data *drv_data = (void *)dev_get_driver_data(dev);
575 struct tpm_chip_priv *priv = dev_get_uclass_priv(dev);
576 struct tpm_chip *chip = dev_get_priv(dev);
577 int ret;
578
579 /* Use the TPM v2 stack */
580 priv->version = TPM_V2;
581
582 if (IS_ENABLED(CONFIG_DM_GPIO)) {
583 struct gpio_desc reset_gpio;
584
585 ret = gpio_request_by_name(dev, "gpio-reset", 0,
586 &reset_gpio, GPIOD_IS_OUT);
587 if (ret) {
588 log(LOGC_NONE, LOGL_NOTICE, "%s: missing reset GPIO\n",
589 __func__);
590 } else {
591 dm_gpio_set_value(&reset_gpio, 0);
592 mdelay(1);
593 dm_gpio_set_value(&reset_gpio, 1);
594 }
595 }
596
597 /* Ensure a minimum amount of time elapsed since reset of the TPM */
598 mdelay(drv_data->time_before_first_cmd_ms);
599
600 chip->locality = 0;
601 chip->timeout_a = TIS_SHORT_TIMEOUT_MS;
602 chip->timeout_b = TIS_LONG_TIMEOUT_MS;
603 chip->timeout_c = TIS_SHORT_TIMEOUT_MS;
604 chip->timeout_d = TIS_SHORT_TIMEOUT_MS;
605 priv->pcr_count = drv_data->pcr_count;
606 priv->pcr_select_min = drv_data->pcr_select_min;
607
608 ret = tpm_tis_wait_init(dev, chip->locality);
609 if (ret) {
610 log(LOGC_DM, LOGL_ERR, "%s: no device found\n", __func__);
611 return ret;
612 }
613
614 ret = tpm_tis_spi_request_locality(dev, chip->locality);
615 if (ret) {
616 log(LOGC_NONE, LOGL_ERR, "%s: could not request locality %d\n",
617 __func__, chip->locality);
618 return ret;
619 }
620
621 ret = tpm_tis_spi_read32(dev, TPM_DID_VID(chip->locality),
622 &chip->vend_dev);
623 if (ret) {
624 log(LOGC_NONE, LOGL_ERR,
625 "%s: could not retrieve VendorID/DeviceID\n", __func__);
626 return ret;
627 }
628
629 ret = tpm_tis_spi_read(dev, TPM_RID(chip->locality), &chip->rid, 1);
630 if (ret) {
631 log(LOGC_NONE, LOGL_ERR, "%s: could not retrieve RevisionID\n",
632 __func__);
633 return ret;
634 }
635
636 log(LOGC_NONE, LOGL_ERR,
637 "SPI TPMv2.0 found (vid:%04x, did:%04x, rid:%02x)\n",
638 chip->vend_dev & 0xFFFF, chip->vend_dev >> 16, chip->rid);
639
640 return 0;
641 }
642
tpm_tis_spi_remove(struct udevice * dev)643 static int tpm_tis_spi_remove(struct udevice *dev)
644 {
645 struct tpm_chip *chip = dev_get_priv(dev);
646
647 tpm_tis_spi_release_locality(dev, chip->locality, true);
648
649 return 0;
650 }
651
652 static const struct tpm_ops tpm_tis_spi_ops = {
653 .open = tpm_tis_spi_open,
654 .close = tpm_tis_spi_close,
655 .get_desc = tpm_tis_get_desc,
656 .send = tpm_tis_spi_send,
657 .recv = tpm_tis_spi_recv,
658 .cleanup = tpm_tis_spi_cleanup,
659 };
660
661 static const struct tpm_tis_chip_data tpm_tis_std_chip_data = {
662 .pcr_count = 24,
663 .pcr_select_min = 3,
664 .time_before_first_cmd_ms = 30,
665 };
666
667 static const struct udevice_id tpm_tis_spi_ids[] = {
668 {
669 .compatible = "tis,tpm2-spi",
670 .data = (ulong)&tpm_tis_std_chip_data,
671 },
672 { }
673 };
674
675 U_BOOT_DRIVER(tpm_tis_spi) = {
676 .name = "tpm_tis_spi",
677 .id = UCLASS_TPM,
678 .of_match = tpm_tis_spi_ids,
679 .ops = &tpm_tis_spi_ops,
680 .probe = tpm_tis_spi_probe,
681 .remove = tpm_tis_spi_remove,
682 .priv_auto_alloc_size = sizeof(struct tpm_chip),
683 };
684