1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Copyright (C) 2016 Google, Inc
4  *
5  * This device driver implements a TCG PTP FIFO interface over SPI for chips
6  * with Cr50 firmware.
7  * It is based on tpm_tis_spi driver by Peter Huewe and Christophe Ricard.
8  */
9 
10 #include <linux/completion.h>
11 #include <linux/interrupt.h>
12 #include <linux/module.h>
13 #include <linux/of.h>
14 #include <linux/pm.h>
15 #include <linux/spi/spi.h>
16 #include <linux/wait.h>
17 
18 #include "tpm_tis_core.h"
19 #include "tpm_tis_spi.h"
20 
21 /*
22  * Cr50 timing constants:
23  * - can go to sleep not earlier than after CR50_SLEEP_DELAY_MSEC.
24  * - needs up to CR50_WAKE_START_DELAY_USEC to wake after sleep.
25  * - requires waiting for "ready" IRQ, if supported; or waiting for at least
26  *   CR50_NOIRQ_ACCESS_DELAY_MSEC between transactions, if IRQ is not supported.
27  * - waits for up to CR50_FLOW_CONTROL for flow control 'ready' indication.
28  */
29 #define CR50_SLEEP_DELAY_MSEC			1000
30 #define CR50_WAKE_START_DELAY_USEC		1000
31 #define CR50_NOIRQ_ACCESS_DELAY			msecs_to_jiffies(2)
32 #define CR50_READY_IRQ_TIMEOUT			msecs_to_jiffies(TPM2_TIMEOUT_A)
33 #define CR50_FLOW_CONTROL			msecs_to_jiffies(TPM2_TIMEOUT_A)
34 #define MAX_IRQ_CONFIRMATION_ATTEMPTS		3
35 
36 #define TPM_CR50_FW_VER(l)			(0x0f90 | ((l) << 12))
37 #define TPM_CR50_MAX_FW_VER_LEN			64
38 
39 /* Default quality for hwrng. */
40 #define TPM_CR50_DEFAULT_RNG_QUALITY		700
41 
42 struct cr50_spi_phy {
43 	struct tpm_tis_spi_phy spi_phy;
44 
45 	struct mutex time_track_mutex;
46 	unsigned long last_access;
47 
48 	unsigned long access_delay;
49 
50 	unsigned int irq_confirmation_attempt;
51 	bool irq_needs_confirmation;
52 	bool irq_confirmed;
53 };
54 
55 static inline struct cr50_spi_phy *to_cr50_spi_phy(struct tpm_tis_spi_phy *phy)
56 {
57 	return container_of(phy, struct cr50_spi_phy, spi_phy);
58 }
59 
60 /*
61  * The cr50 interrupt handler just signals waiting threads that the
62  * interrupt was asserted.  It does not do any processing triggered
63  * by interrupts but is instead used to avoid fixed delays.
64  */
65 static irqreturn_t cr50_spi_irq_handler(int dummy, void *dev_id)
66 {
67 	struct cr50_spi_phy *cr50_phy = dev_id;
68 
69 	cr50_phy->irq_confirmed = true;
70 	complete(&cr50_phy->spi_phy.ready);
71 
72 	return IRQ_HANDLED;
73 }
74 
75 /*
76  * Cr50 needs to have at least some delay between consecutive
77  * transactions. Make sure we wait.
78  */
79 static void cr50_ensure_access_delay(struct cr50_spi_phy *phy)
80 {
81 	unsigned long allowed_access = phy->last_access + phy->access_delay;
82 	unsigned long time_now = jiffies;
83 	struct device *dev = &phy->spi_phy.spi_device->dev;
84 
85 	/*
86 	 * Note: There is a small chance, if Cr50 is not accessed in a few days,
87 	 * that time_in_range will not provide the correct result after the wrap
88 	 * around for jiffies. In this case, we'll have an unneeded short delay,
89 	 * which is fine.
90 	 */
91 	if (time_in_range_open(time_now, phy->last_access, allowed_access)) {
92 		unsigned long remaining, timeout = allowed_access - time_now;
93 
94 		remaining = wait_for_completion_timeout(&phy->spi_phy.ready,
95 							timeout);
96 		if (!remaining && phy->irq_confirmed)
97 			dev_warn(dev, "Timeout waiting for TPM ready IRQ\n");
98 	}
99 
100 	if (phy->irq_needs_confirmation) {
101 		unsigned int attempt = ++phy->irq_confirmation_attempt;
102 
103 		if (phy->irq_confirmed) {
104 			phy->irq_needs_confirmation = false;
105 			phy->access_delay = CR50_READY_IRQ_TIMEOUT;
106 			dev_info(dev, "TPM ready IRQ confirmed on attempt %u\n",
107 				 attempt);
108 		} else if (attempt > MAX_IRQ_CONFIRMATION_ATTEMPTS) {
109 			phy->irq_needs_confirmation = false;
110 			dev_warn(dev, "IRQ not confirmed - will use delays\n");
111 		}
112 	}
113 }
114 
115 /*
116  * Cr50 might go to sleep if there is no SPI activity for some time and
117  * miss the first few bits/bytes on the bus. In such case, wake it up
118  * by asserting CS and give it time to start up.
119  */
120 static bool cr50_needs_waking(struct cr50_spi_phy *phy)
121 {
122 	/*
123 	 * Note: There is a small chance, if Cr50 is not accessed in a few days,
124 	 * that time_in_range will not provide the correct result after the wrap
125 	 * around for jiffies. In this case, we'll probably timeout or read
126 	 * incorrect value from TPM_STS and just retry the operation.
127 	 */
128 	return !time_in_range_open(jiffies, phy->last_access,
129 				   phy->spi_phy.wake_after);
130 }
131 
132 static void cr50_wake_if_needed(struct cr50_spi_phy *cr50_phy)
133 {
134 	struct tpm_tis_spi_phy *phy = &cr50_phy->spi_phy;
135 
136 	if (cr50_needs_waking(cr50_phy)) {
137 		/* Assert CS, wait 1 msec, deassert CS */
138 		struct spi_transfer spi_cs_wake = {
139 			.delay = {
140 				.value = 1000,
141 				.unit = SPI_DELAY_UNIT_USECS
142 			}
143 		};
144 
145 		spi_sync_transfer(phy->spi_device, &spi_cs_wake, 1);
146 		/* Wait for it to fully wake */
147 		usleep_range(CR50_WAKE_START_DELAY_USEC,
148 			     CR50_WAKE_START_DELAY_USEC * 2);
149 	}
150 
151 	/* Reset the time when we need to wake Cr50 again */
152 	phy->wake_after = jiffies + msecs_to_jiffies(CR50_SLEEP_DELAY_MSEC);
153 }
154 
155 /*
156  * Flow control: clock the bus and wait for cr50 to set LSB before
157  * sending/receiving data. TCG PTP spec allows it to happen during
158  * the last byte of header, but cr50 never does that in practice,
159  * and earlier versions had a bug when it was set too early, so don't
160  * check for it during header transfer.
161  */
162 static int cr50_spi_flow_control(struct tpm_tis_spi_phy *phy,
163 				 struct spi_transfer *spi_xfer)
164 {
165 	struct device *dev = &phy->spi_device->dev;
166 	unsigned long timeout = jiffies + CR50_FLOW_CONTROL;
167 	struct spi_message m;
168 	int ret;
169 
170 	spi_xfer->len = 1;
171 
172 	do {
173 		spi_message_init(&m);
174 		spi_message_add_tail(spi_xfer, &m);
175 		ret = spi_sync_locked(phy->spi_device, &m);
176 		if (ret < 0)
177 			return ret;
178 
179 		if (time_after(jiffies, timeout)) {
180 			dev_warn(dev, "Timeout during flow control\n");
181 			return -EBUSY;
182 		}
183 	} while (!(phy->iobuf[0] & 0x01));
184 
185 	return 0;
186 }
187 
188 static bool tpm_cr50_spi_is_firmware_power_managed(struct device *dev)
189 {
190 	u8 val;
191 	int ret;
192 
193 	/* This flag should default true when the device property is not present */
194 	ret = device_property_read_u8(dev, "firmware-power-managed", &val);
195 	if (ret)
196 		return true;
197 
198 	return val;
199 }
200 
201 static int tpm_tis_spi_cr50_transfer(struct tpm_tis_data *data, u32 addr, u16 len,
202 				     u8 *in, const u8 *out)
203 {
204 	struct tpm_tis_spi_phy *phy = to_tpm_tis_spi_phy(data);
205 	struct cr50_spi_phy *cr50_phy = to_cr50_spi_phy(phy);
206 	int ret;
207 
208 	mutex_lock(&cr50_phy->time_track_mutex);
209 	/*
210 	 * Do this outside of spi_bus_lock in case cr50 is not the
211 	 * only device on that spi bus.
212 	 */
213 	cr50_ensure_access_delay(cr50_phy);
214 	cr50_wake_if_needed(cr50_phy);
215 
216 	ret = tpm_tis_spi_transfer(data, addr, len, in, out);
217 
218 	cr50_phy->last_access = jiffies;
219 	mutex_unlock(&cr50_phy->time_track_mutex);
220 
221 	return ret;
222 }
223 
224 static int tpm_tis_spi_cr50_read_bytes(struct tpm_tis_data *data, u32 addr,
225 				       u16 len, u8 *result)
226 {
227 	return tpm_tis_spi_cr50_transfer(data, addr, len, result, NULL);
228 }
229 
230 static int tpm_tis_spi_cr50_write_bytes(struct tpm_tis_data *data, u32 addr,
231 					u16 len, const u8 *value)
232 {
233 	return tpm_tis_spi_cr50_transfer(data, addr, len, NULL, value);
234 }
235 
236 static const struct tpm_tis_phy_ops tpm_spi_cr50_phy_ops = {
237 	.read_bytes = tpm_tis_spi_cr50_read_bytes,
238 	.write_bytes = tpm_tis_spi_cr50_write_bytes,
239 	.read16 = tpm_tis_spi_read16,
240 	.read32 = tpm_tis_spi_read32,
241 	.write32 = tpm_tis_spi_write32,
242 };
243 
244 static void cr50_print_fw_version(struct tpm_tis_data *data)
245 {
246 	struct tpm_tis_spi_phy *phy = to_tpm_tis_spi_phy(data);
247 	int i, len = 0;
248 	char fw_ver[TPM_CR50_MAX_FW_VER_LEN + 1];
249 	char fw_ver_block[4];
250 
251 	/*
252 	 * Write anything to TPM_CR50_FW_VER to start from the beginning
253 	 * of the version string
254 	 */
255 	tpm_tis_write8(data, TPM_CR50_FW_VER(data->locality), 0);
256 
257 	/* Read the string, 4 bytes at a time, until we get '\0' */
258 	do {
259 		tpm_tis_read_bytes(data, TPM_CR50_FW_VER(data->locality), 4,
260 				   fw_ver_block);
261 		for (i = 0; i < 4 && fw_ver_block[i]; ++len, ++i)
262 			fw_ver[len] = fw_ver_block[i];
263 	} while (i == 4 && len < TPM_CR50_MAX_FW_VER_LEN);
264 	fw_ver[len] = '\0';
265 
266 	dev_info(&phy->spi_device->dev, "Cr50 firmware version: %s\n", fw_ver);
267 }
268 
269 int cr50_spi_probe(struct spi_device *spi)
270 {
271 	struct tpm_tis_spi_phy *phy;
272 	struct cr50_spi_phy *cr50_phy;
273 	int ret;
274 	struct tpm_chip *chip;
275 
276 	cr50_phy = devm_kzalloc(&spi->dev, sizeof(*cr50_phy), GFP_KERNEL);
277 	if (!cr50_phy)
278 		return -ENOMEM;
279 
280 	phy = &cr50_phy->spi_phy;
281 	phy->flow_control = cr50_spi_flow_control;
282 	phy->wake_after = jiffies;
283 	phy->priv.rng_quality = TPM_CR50_DEFAULT_RNG_QUALITY;
284 	init_completion(&phy->ready);
285 
286 	cr50_phy->access_delay = CR50_NOIRQ_ACCESS_DELAY;
287 	cr50_phy->last_access = jiffies;
288 	mutex_init(&cr50_phy->time_track_mutex);
289 
290 	if (spi->irq > 0) {
291 		ret = devm_request_irq(&spi->dev, spi->irq,
292 				       cr50_spi_irq_handler,
293 				       IRQF_TRIGGER_RISING | IRQF_ONESHOT,
294 				       "cr50_spi", cr50_phy);
295 		if (ret < 0) {
296 			if (ret == -EPROBE_DEFER)
297 				return ret;
298 			dev_warn(&spi->dev, "Requesting IRQ %d failed: %d\n",
299 				 spi->irq, ret);
300 			/*
301 			 * This is not fatal, the driver will fall back to
302 			 * delays automatically, since ready will never
303 			 * be completed without a registered irq handler.
304 			 * So, just fall through.
305 			 */
306 		} else {
307 			/*
308 			 * IRQ requested, let's verify that it is actually
309 			 * triggered, before relying on it.
310 			 */
311 			cr50_phy->irq_needs_confirmation = true;
312 		}
313 	} else {
314 		dev_warn(&spi->dev,
315 			 "No IRQ - will use delays between transactions.\n");
316 	}
317 
318 	ret = tpm_tis_spi_init(spi, phy, -1, &tpm_spi_cr50_phy_ops);
319 	if (ret)
320 		return ret;
321 
322 	cr50_print_fw_version(&phy->priv);
323 
324 	chip = dev_get_drvdata(&spi->dev);
325 	if (tpm_cr50_spi_is_firmware_power_managed(&spi->dev))
326 		chip->flags |= TPM_CHIP_FLAG_FIRMWARE_POWER_MANAGED;
327 
328 	return 0;
329 }
330 
331 #ifdef CONFIG_PM_SLEEP
332 int tpm_tis_spi_resume(struct device *dev)
333 {
334 	struct tpm_chip *chip = dev_get_drvdata(dev);
335 	struct tpm_tis_data *data = dev_get_drvdata(&chip->dev);
336 	struct tpm_tis_spi_phy *phy = to_tpm_tis_spi_phy(data);
337 	/*
338 	 * Jiffies not increased during suspend, so we need to reset
339 	 * the time to wake Cr50 after resume.
340 	 */
341 	phy->wake_after = jiffies;
342 
343 	return tpm_tis_resume(dev);
344 }
345 #endif
346