xref: /openbmc/linux/drivers/char/tpm/tpm_crb.c (revision 0edbfea5)
1 /*
2  * Copyright (C) 2014 Intel Corporation
3  *
4  * Authors:
5  * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
6  *
7  * Maintained by: <tpmdd-devel@lists.sourceforge.net>
8  *
9  * This device driver implements the TPM interface as defined in
10  * the TCG CRB 2.0 TPM specification.
11  *
12  * This program is free software; you can redistribute it and/or
13  * modify it under the terms of the GNU General Public License
14  * as published by the Free Software Foundation; version 2
15  * of the License.
16  */
17 
18 #include <linux/acpi.h>
19 #include <linux/highmem.h>
20 #include <linux/rculist.h>
21 #include <linux/module.h>
22 #include <linux/platform_device.h>
23 #include "tpm.h"
24 
25 #define ACPI_SIG_TPM2 "TPM2"
26 
27 static const u8 CRB_ACPI_START_UUID[] = {
28 	/* 0000 */ 0xAB, 0x6C, 0xBF, 0x6B, 0x63, 0x54, 0x14, 0x47,
29 	/* 0008 */ 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4
30 };
31 
32 enum crb_defaults {
33 	CRB_ACPI_START_REVISION_ID = 1,
34 	CRB_ACPI_START_INDEX = 1,
35 };
36 
37 enum crb_ca_request {
38 	CRB_CA_REQ_GO_IDLE	= BIT(0),
39 	CRB_CA_REQ_CMD_READY	= BIT(1),
40 };
41 
42 enum crb_ca_status {
43 	CRB_CA_STS_ERROR	= BIT(0),
44 	CRB_CA_STS_TPM_IDLE	= BIT(1),
45 };
46 
47 enum crb_start {
48 	CRB_START_INVOKE	= BIT(0),
49 };
50 
51 enum crb_cancel {
52 	CRB_CANCEL_INVOKE	= BIT(0),
53 };
54 
55 struct crb_control_area {
56 	u32 req;
57 	u32 sts;
58 	u32 cancel;
59 	u32 start;
60 	u32 int_enable;
61 	u32 int_sts;
62 	u32 cmd_size;
63 	u32 cmd_pa_low;
64 	u32 cmd_pa_high;
65 	u32 rsp_size;
66 	u64 rsp_pa;
67 } __packed;
68 
69 enum crb_status {
70 	CRB_STS_COMPLETE	= BIT(0),
71 };
72 
73 enum crb_flags {
74 	CRB_FL_ACPI_START	= BIT(0),
75 	CRB_FL_CRB_START	= BIT(1),
76 };
77 
78 struct crb_priv {
79 	unsigned int flags;
80 	void __iomem *iobase;
81 	struct crb_control_area __iomem *cca;
82 	u8 __iomem *cmd;
83 	u8 __iomem *rsp;
84 };
85 
86 static SIMPLE_DEV_PM_OPS(crb_pm, tpm_pm_suspend, tpm_pm_resume);
87 
88 static u8 crb_status(struct tpm_chip *chip)
89 {
90 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
91 	u8 sts = 0;
92 
93 	if ((ioread32(&priv->cca->start) & CRB_START_INVOKE) !=
94 	    CRB_START_INVOKE)
95 		sts |= CRB_STS_COMPLETE;
96 
97 	return sts;
98 }
99 
100 static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
101 {
102 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
103 	unsigned int expected;
104 
105 	/* sanity check */
106 	if (count < 6)
107 		return -EIO;
108 
109 	if (ioread32(&priv->cca->sts) & CRB_CA_STS_ERROR)
110 		return -EIO;
111 
112 	memcpy_fromio(buf, priv->rsp, 6);
113 	expected = be32_to_cpup((__be32 *) &buf[2]);
114 
115 	if (expected > count)
116 		return -EIO;
117 
118 	memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6);
119 
120 	return expected;
121 }
122 
123 static int crb_do_acpi_start(struct tpm_chip *chip)
124 {
125 	union acpi_object *obj;
126 	int rc;
127 
128 	obj = acpi_evaluate_dsm(chip->acpi_dev_handle,
129 				CRB_ACPI_START_UUID,
130 				CRB_ACPI_START_REVISION_ID,
131 				CRB_ACPI_START_INDEX,
132 				NULL);
133 	if (!obj)
134 		return -ENXIO;
135 	rc = obj->integer.value == 0 ? 0 : -ENXIO;
136 	ACPI_FREE(obj);
137 	return rc;
138 }
139 
140 static int crb_send(struct tpm_chip *chip, u8 *buf, size_t len)
141 {
142 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
143 	int rc = 0;
144 
145 	if (len > ioread32(&priv->cca->cmd_size)) {
146 		dev_err(&chip->dev,
147 			"invalid command count value %x %zx\n",
148 			(unsigned int) len,
149 			(size_t) ioread32(&priv->cca->cmd_size));
150 		return -E2BIG;
151 	}
152 
153 	memcpy_toio(priv->cmd, buf, len);
154 
155 	/* Make sure that cmd is populated before issuing start. */
156 	wmb();
157 
158 	if (priv->flags & CRB_FL_CRB_START)
159 		iowrite32(cpu_to_le32(CRB_START_INVOKE), &priv->cca->start);
160 
161 	if (priv->flags & CRB_FL_ACPI_START)
162 		rc = crb_do_acpi_start(chip);
163 
164 	return rc;
165 }
166 
167 static void crb_cancel(struct tpm_chip *chip)
168 {
169 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
170 
171 	iowrite32(cpu_to_le32(CRB_CANCEL_INVOKE), &priv->cca->cancel);
172 
173 	/* Make sure that cmd is populated before issuing cancel. */
174 	wmb();
175 
176 	if ((priv->flags & CRB_FL_ACPI_START) && crb_do_acpi_start(chip))
177 		dev_err(&chip->dev, "ACPI Start failed\n");
178 
179 	iowrite32(0, &priv->cca->cancel);
180 }
181 
182 static bool crb_req_canceled(struct tpm_chip *chip, u8 status)
183 {
184 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
185 	u32 cancel = ioread32(&priv->cca->cancel);
186 
187 	return (cancel & CRB_CANCEL_INVOKE) == CRB_CANCEL_INVOKE;
188 }
189 
190 static const struct tpm_class_ops tpm_crb = {
191 	.status = crb_status,
192 	.recv = crb_recv,
193 	.send = crb_send,
194 	.cancel = crb_cancel,
195 	.req_canceled = crb_req_canceled,
196 	.req_complete_mask = CRB_STS_COMPLETE,
197 	.req_complete_val = CRB_STS_COMPLETE,
198 };
199 
200 static int crb_init(struct acpi_device *device, struct crb_priv *priv)
201 {
202 	struct tpm_chip *chip;
203 	int rc;
204 
205 	chip = tpmm_chip_alloc(&device->dev, &tpm_crb);
206 	if (IS_ERR(chip))
207 		return PTR_ERR(chip);
208 
209 	dev_set_drvdata(&chip->dev, priv);
210 	chip->acpi_dev_handle = device->handle;
211 	chip->flags = TPM_CHIP_FLAG_TPM2;
212 
213 	rc = tpm_get_timeouts(chip);
214 	if (rc)
215 		return rc;
216 
217 	rc = tpm2_do_selftest(chip);
218 	if (rc)
219 		return rc;
220 
221 	return tpm_chip_register(chip);
222 }
223 
224 static int crb_check_resource(struct acpi_resource *ares, void *data)
225 {
226 	struct resource *io_res = data;
227 	struct resource res;
228 
229 	if (acpi_dev_resource_memory(ares, &res)) {
230 		*io_res = res;
231 		io_res->name = NULL;
232 	}
233 
234 	return 1;
235 }
236 
237 static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
238 				 struct resource *io_res, u64 start, u32 size)
239 {
240 	struct resource new_res = {
241 		.start	= start,
242 		.end	= start + size - 1,
243 		.flags	= IORESOURCE_MEM,
244 	};
245 
246 	/* Detect a 64 bit address on a 32 bit system */
247 	if (start != new_res.start)
248 		return ERR_PTR(-EINVAL);
249 
250 	if (!resource_contains(io_res, &new_res))
251 		return devm_ioremap_resource(dev, &new_res);
252 
253 	return priv->iobase + (new_res.start - io_res->start);
254 }
255 
256 static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
257 		      struct acpi_table_tpm2 *buf)
258 {
259 	struct list_head resources;
260 	struct resource io_res;
261 	struct device *dev = &device->dev;
262 	u64 cmd_pa;
263 	u32 cmd_size;
264 	u64 rsp_pa;
265 	u32 rsp_size;
266 	int ret;
267 
268 	INIT_LIST_HEAD(&resources);
269 	ret = acpi_dev_get_resources(device, &resources, crb_check_resource,
270 				     &io_res);
271 	if (ret < 0)
272 		return ret;
273 	acpi_dev_free_resource_list(&resources);
274 
275 	if (resource_type(&io_res) != IORESOURCE_MEM) {
276 		dev_err(dev,
277 			FW_BUG "TPM2 ACPI table does not define a memory resource\n");
278 		return -EINVAL;
279 	}
280 
281 	priv->iobase = devm_ioremap_resource(dev, &io_res);
282 	if (IS_ERR(priv->iobase))
283 		return PTR_ERR(priv->iobase);
284 
285 	priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address,
286 				sizeof(struct crb_control_area));
287 	if (IS_ERR(priv->cca))
288 		return PTR_ERR(priv->cca);
289 
290 	cmd_pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
291 		  (u64) ioread32(&priv->cca->cmd_pa_low);
292 	cmd_size = ioread32(&priv->cca->cmd_size);
293 	priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size);
294 	if (IS_ERR(priv->cmd))
295 		return PTR_ERR(priv->cmd);
296 
297 	memcpy_fromio(&rsp_pa, &priv->cca->rsp_pa, 8);
298 	rsp_pa = le64_to_cpu(rsp_pa);
299 	rsp_size = ioread32(&priv->cca->rsp_size);
300 
301 	if (cmd_pa != rsp_pa) {
302 		priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size);
303 		return PTR_ERR_OR_ZERO(priv->rsp);
304 	}
305 
306 	/* According to the PTP specification, overlapping command and response
307 	 * buffer sizes must be identical.
308 	 */
309 	if (cmd_size != rsp_size) {
310 		dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
311 		return -EINVAL;
312 	}
313 
314 	priv->rsp = priv->cmd;
315 	return 0;
316 }
317 
318 static int crb_acpi_add(struct acpi_device *device)
319 {
320 	struct acpi_table_tpm2 *buf;
321 	struct crb_priv *priv;
322 	struct device *dev = &device->dev;
323 	acpi_status status;
324 	u32 sm;
325 	int rc;
326 
327 	status = acpi_get_table(ACPI_SIG_TPM2, 1,
328 				(struct acpi_table_header **) &buf);
329 	if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) {
330 		dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n");
331 		return -EINVAL;
332 	}
333 
334 	/* Should the FIFO driver handle this? */
335 	sm = buf->start_method;
336 	if (sm == ACPI_TPM2_MEMORY_MAPPED)
337 		return -ENODEV;
338 
339 	priv = devm_kzalloc(dev, sizeof(struct crb_priv), GFP_KERNEL);
340 	if (!priv)
341 		return -ENOMEM;
342 
343 	/* The reason for the extra quirk is that the PTT in 4th Gen Core CPUs
344 	 * report only ACPI start but in practice seems to require both
345 	 * ACPI start and CRB start.
346 	 */
347 	if (sm == ACPI_TPM2_COMMAND_BUFFER || sm == ACPI_TPM2_MEMORY_MAPPED ||
348 	    !strcmp(acpi_device_hid(device), "MSFT0101"))
349 		priv->flags |= CRB_FL_CRB_START;
350 
351 	if (sm == ACPI_TPM2_START_METHOD ||
352 	    sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD)
353 		priv->flags |= CRB_FL_ACPI_START;
354 
355 	rc = crb_map_io(device, priv, buf);
356 	if (rc)
357 		return rc;
358 
359 	return crb_init(device, priv);
360 }
361 
362 static int crb_acpi_remove(struct acpi_device *device)
363 {
364 	struct device *dev = &device->dev;
365 	struct tpm_chip *chip = dev_get_drvdata(dev);
366 
367 	tpm_chip_unregister(chip);
368 
369 	return 0;
370 }
371 
372 static struct acpi_device_id crb_device_ids[] = {
373 	{"MSFT0101", 0},
374 	{"", 0},
375 };
376 MODULE_DEVICE_TABLE(acpi, crb_device_ids);
377 
378 static struct acpi_driver crb_acpi_driver = {
379 	.name = "tpm_crb",
380 	.ids = crb_device_ids,
381 	.ops = {
382 		.add = crb_acpi_add,
383 		.remove = crb_acpi_remove,
384 	},
385 	.drv = {
386 		.pm = &crb_pm,
387 	},
388 };
389 
390 module_acpi_driver(crb_acpi_driver);
391 MODULE_AUTHOR("Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>");
392 MODULE_DESCRIPTION("TPM2 Driver");
393 MODULE_VERSION("0.1");
394 MODULE_LICENSE("GPL");
395