1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Author: 4 * Miquel Raynal <miquel.raynal@bootlin.com> 5 * 6 * Description: 7 * SPI-level driver for TCG/TIS TPM (trusted platform module). 8 * Specifications at www.trustedcomputinggroup.org 9 * 10 * This device driver implements the TPM interface as defined in 11 * the TCG SPI protocol stack version 2.0. 12 * 13 * It is based on the U-Boot driver tpm_tis_infineon_i2c.c. 14 */ 15 16 #include <common.h> 17 #include <dm.h> 18 #include <fdtdec.h> 19 #include <log.h> 20 #include <spi.h> 21 #include <tpm-v2.h> 22 #include <linux/errno.h> 23 #include <linux/compiler.h> 24 #include <linux/types.h> 25 #include <linux/unaligned/be_byteshift.h> 26 #include <asm-generic/gpio.h> 27 28 #include "tpm_tis.h" 29 #include "tpm_internal.h" 30 31 DECLARE_GLOBAL_DATA_PTR; 32 33 #define TPM_ACCESS(l) (0x0000 | ((l) << 12)) 34 #define TPM_INT_ENABLE(l) (0x0008 | ((l) << 12)) 35 #define TPM_STS(l) (0x0018 | ((l) << 12)) 36 #define TPM_DATA_FIFO(l) (0x0024 | ((l) << 12)) 37 #define TPM_DID_VID(l) (0x0F00 | ((l) << 12)) 38 #define TPM_RID(l) (0x0F04 | ((l) << 12)) 39 40 #define MAX_SPI_FRAMESIZE 64 41 42 /* Number of wait states to wait for */ 43 #define TPM_WAIT_STATES 100 44 45 /** 46 * struct tpm_tis_chip_data - Non-discoverable TPM information 47 * 48 * @pcr_count: Number of PCR per bank 49 * @pcr_select_min: Size in octets of the pcrSelect array 50 */ 51 struct tpm_tis_chip_data { 52 unsigned int pcr_count; 53 unsigned int pcr_select_min; 54 unsigned int time_before_first_cmd_ms; 55 }; 56 57 /** 58 * tpm_tis_spi_read() - Read from TPM register 59 * 60 * @addr: register address to read from 61 * @buffer: provided by caller 62 * @len: number of bytes to read 63 * 64 * Read len bytes from TPM register and put them into 65 * buffer (little-endian format, i.e. first byte is put into buffer[0]). 66 * 67 * NOTE: TPM is big-endian for multi-byte values. Multi-byte 68 * values have to be swapped. 69 * 70 * @return -EIO on error, 0 on success. 71 */ 72 static int tpm_tis_spi_xfer(struct udevice *dev, u32 addr, const u8 *out, 73 u8 *in, u16 len) 74 { 75 struct spi_slave *slave = dev_get_parent_priv(dev); 76 int transfer_len, ret; 77 u8 tx_buf[MAX_SPI_FRAMESIZE]; 78 u8 rx_buf[MAX_SPI_FRAMESIZE]; 79 80 if (in && out) { 81 log(LOGC_NONE, LOGL_ERR, "%s: can't do full duplex\n", 82 __func__); 83 return -EINVAL; 84 } 85 86 ret = spi_claim_bus(slave); 87 if (ret < 0) { 88 log(LOGC_NONE, LOGL_ERR, "%s: could not claim bus\n", __func__); 89 return ret; 90 } 91 92 while (len) { 93 /* Request */ 94 transfer_len = min_t(u16, len, MAX_SPI_FRAMESIZE); 95 tx_buf[0] = (in ? BIT(7) : 0) | (transfer_len - 1); 96 tx_buf[1] = 0xD4; 97 tx_buf[2] = addr >> 8; 98 tx_buf[3] = addr; 99 100 ret = spi_xfer(slave, 4 * 8, tx_buf, rx_buf, SPI_XFER_BEGIN); 101 if (ret < 0) { 102 log(LOGC_NONE, LOGL_ERR, 103 "%s: spi request transfer failed (err: %d)\n", 104 __func__, ret); 105 goto release_bus; 106 } 107 108 /* Wait state */ 109 if (!(rx_buf[3] & 0x1)) { 110 int i; 111 112 for (i = 0; i < TPM_WAIT_STATES; i++) { 113 ret = spi_xfer(slave, 1 * 8, NULL, rx_buf, 0); 114 if (ret) { 115 log(LOGC_NONE, LOGL_ERR, 116 "%s: wait state failed: %d\n", 117 __func__, ret); 118 goto release_bus; 119 } 120 121 if (rx_buf[0] & 0x1) 122 break; 123 } 124 125 if (i == TPM_WAIT_STATES) { 126 log(LOGC_NONE, LOGL_ERR, 127 "%s: timeout on wait state\n", __func__); 128 ret = -ETIMEDOUT; 129 goto release_bus; 130 } 131 } 132 133 /* Read/Write */ 134 if (out) { 135 memcpy(tx_buf, out, transfer_len); 136 out += transfer_len; 137 } 138 139 ret = spi_xfer(slave, transfer_len * 8, 140 out ? tx_buf : NULL, 141 in ? rx_buf : NULL, 142 SPI_XFER_END); 143 if (ret) { 144 log(LOGC_NONE, LOGL_ERR, 145 "%s: spi read transfer failed (err: %d)\n", 146 __func__, ret); 147 goto release_bus; 148 } 149 150 if (in) { 151 memcpy(in, rx_buf, transfer_len); 152 in += transfer_len; 153 } 154 155 len -= transfer_len; 156 } 157 158 release_bus: 159 /* If an error occurred, release the chip by deasserting the CS */ 160 if (ret < 0) 161 spi_xfer(slave, 0, NULL, NULL, SPI_XFER_END); 162 163 spi_release_bus(slave); 164 165 return ret; 166 } 167 168 static int tpm_tis_spi_read(struct udevice *dev, u16 addr, u8 *in, u16 len) 169 { 170 return tpm_tis_spi_xfer(dev, addr, NULL, in, len); 171 } 172 173 static int tpm_tis_spi_read32(struct udevice *dev, u32 addr, u32 *result) 174 { 175 __le32 result_le; 176 int ret; 177 178 ret = tpm_tis_spi_read(dev, addr, (u8 *)&result_le, sizeof(u32)); 179 if (!ret) 180 *result = le32_to_cpu(result_le); 181 182 return ret; 183 } 184 185 static int tpm_tis_spi_write(struct udevice *dev, u16 addr, const u8 *out, 186 u16 len) 187 { 188 return tpm_tis_spi_xfer(dev, addr, out, NULL, len); 189 } 190 191 static int tpm_tis_spi_check_locality(struct udevice *dev, int loc) 192 { 193 const u8 mask = TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID; 194 struct tpm_chip *chip = dev_get_priv(dev); 195 u8 buf; 196 int ret; 197 198 ret = tpm_tis_spi_read(dev, TPM_ACCESS(loc), &buf, 1); 199 if (ret) 200 return ret; 201 202 if ((buf & mask) == mask) { 203 chip->locality = loc; 204 return 0; 205 } 206 207 return -ENOENT; 208 } 209 210 static void tpm_tis_spi_release_locality(struct udevice *dev, int loc, 211 bool force) 212 { 213 const u8 mask = TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID; 214 u8 buf; 215 216 if (tpm_tis_spi_read(dev, TPM_ACCESS(loc), &buf, 1) < 0) 217 return; 218 219 if (force || (buf & mask) == mask) { 220 buf = TPM_ACCESS_ACTIVE_LOCALITY; 221 tpm_tis_spi_write(dev, TPM_ACCESS(loc), &buf, 1); 222 } 223 } 224 225 static int tpm_tis_spi_request_locality(struct udevice *dev, int loc) 226 { 227 struct tpm_chip *chip = dev_get_priv(dev); 228 unsigned long start, stop; 229 u8 buf = TPM_ACCESS_REQUEST_USE; 230 int ret; 231 232 ret = tpm_tis_spi_check_locality(dev, loc); 233 if (!ret) 234 return 0; 235 236 if (ret != -ENOENT) { 237 log(LOGC_NONE, LOGL_ERR, "%s: Failed to get locality: %d\n", 238 __func__, ret); 239 return ret; 240 } 241 242 ret = tpm_tis_spi_write(dev, TPM_ACCESS(loc), &buf, 1); 243 if (ret) { 244 log(LOGC_NONE, LOGL_ERR, "%s: Failed to write to TPM: %d\n", 245 __func__, ret); 246 return ret; 247 } 248 249 start = get_timer(0); 250 stop = chip->timeout_a; 251 do { 252 ret = tpm_tis_spi_check_locality(dev, loc); 253 if (!ret) 254 return 0; 255 256 if (ret != -ENOENT) { 257 log(LOGC_NONE, LOGL_ERR, 258 "%s: Failed to get locality: %d\n", __func__, ret); 259 return ret; 260 } 261 262 mdelay(TPM_TIMEOUT_MS); 263 } while (get_timer(start) < stop); 264 265 log(LOGC_NONE, LOGL_ERR, "%s: Timeout getting locality: %d\n", __func__, 266 ret); 267 268 return ret; 269 } 270 271 static u8 tpm_tis_spi_status(struct udevice *dev, u8 *status) 272 { 273 struct tpm_chip *chip = dev_get_priv(dev); 274 275 return tpm_tis_spi_read(dev, TPM_STS(chip->locality), status, 1); 276 } 277 278 static int tpm_tis_spi_wait_for_stat(struct udevice *dev, u8 mask, 279 unsigned long timeout, u8 *status) 280 { 281 unsigned long start = get_timer(0); 282 unsigned long stop = timeout; 283 int ret; 284 285 do { 286 mdelay(TPM_TIMEOUT_MS); 287 ret = tpm_tis_spi_status(dev, status); 288 if (ret) 289 return ret; 290 291 if ((*status & mask) == mask) 292 return 0; 293 } while (get_timer(start) < stop); 294 295 return -ETIMEDOUT; 296 } 297 298 static int tpm_tis_spi_get_burstcount(struct udevice *dev) 299 { 300 struct tpm_chip *chip = dev_get_priv(dev); 301 unsigned long start, stop; 302 u32 burstcount, ret; 303 304 /* wait for burstcount */ 305 start = get_timer(0); 306 stop = chip->timeout_d; 307 do { 308 ret = tpm_tis_spi_read32(dev, TPM_STS(chip->locality), 309 &burstcount); 310 if (ret) 311 return -EBUSY; 312 313 burstcount = (burstcount >> 8) & 0xFFFF; 314 if (burstcount) 315 return burstcount; 316 317 mdelay(TPM_TIMEOUT_MS); 318 } while (get_timer(start) < stop); 319 320 return -EBUSY; 321 } 322 323 static int tpm_tis_spi_cancel(struct udevice *dev) 324 { 325 struct tpm_chip *chip = dev_get_priv(dev); 326 u8 data = TPM_STS_COMMAND_READY; 327 328 return tpm_tis_spi_write(dev, TPM_STS(chip->locality), &data, 1); 329 } 330 331 static int tpm_tis_spi_recv_data(struct udevice *dev, u8 *buf, size_t count) 332 { 333 struct tpm_chip *chip = dev_get_priv(dev); 334 int size = 0, burstcnt, len, ret; 335 u8 status; 336 337 while (size < count && 338 tpm_tis_spi_wait_for_stat(dev, 339 TPM_STS_DATA_AVAIL | TPM_STS_VALID, 340 chip->timeout_c, &status) == 0) { 341 burstcnt = tpm_tis_spi_get_burstcount(dev); 342 if (burstcnt < 0) 343 return burstcnt; 344 345 len = min_t(int, burstcnt, count - size); 346 ret = tpm_tis_spi_read(dev, TPM_DATA_FIFO(chip->locality), 347 buf + size, len); 348 if (ret < 0) 349 return ret; 350 351 size += len; 352 } 353 354 return size; 355 } 356 357 static int tpm_tis_spi_recv(struct udevice *dev, u8 *buf, size_t count) 358 { 359 struct tpm_chip *chip = dev_get_priv(dev); 360 int size, expected; 361 362 if (!chip) 363 return -ENODEV; 364 365 if (count < TPM_HEADER_SIZE) { 366 size = -EIO; 367 goto out; 368 } 369 370 size = tpm_tis_spi_recv_data(dev, buf, TPM_HEADER_SIZE); 371 if (size < TPM_HEADER_SIZE) { 372 log(LOGC_NONE, LOGL_ERR, "TPM error, unable to read header\n"); 373 goto out; 374 } 375 376 expected = get_unaligned_be32(buf + 2); 377 if (expected > count) { 378 size = -EIO; 379 goto out; 380 } 381 382 size += tpm_tis_spi_recv_data(dev, &buf[TPM_HEADER_SIZE], 383 expected - TPM_HEADER_SIZE); 384 if (size < expected) { 385 log(LOGC_NONE, LOGL_ERR, 386 "TPM error, unable to read remaining bytes of result\n"); 387 size = -EIO; 388 goto out; 389 } 390 391 out: 392 tpm_tis_spi_cancel(dev); 393 tpm_tis_spi_release_locality(dev, chip->locality, false); 394 395 return size; 396 } 397 398 static int tpm_tis_spi_send(struct udevice *dev, const u8 *buf, size_t len) 399 { 400 struct tpm_chip *chip = dev_get_priv(dev); 401 u32 i, size; 402 u8 status; 403 int burstcnt, ret; 404 u8 data; 405 406 if (!chip) 407 return -ENODEV; 408 409 if (len > TPM_DEV_BUFSIZE) 410 return -E2BIG; /* Command is too long for our tpm, sorry */ 411 412 ret = tpm_tis_spi_request_locality(dev, 0); 413 if (ret < 0) 414 return -EBUSY; 415 416 /* 417 * Check if the TPM is ready. If not, if not, cancel the pending command 418 * and poll on the status to be finally ready. 419 */ 420 ret = tpm_tis_spi_status(dev, &status); 421 if (ret) 422 return ret; 423 424 if (!(status & TPM_STS_COMMAND_READY)) { 425 /* Force the transition, usually this will be done at startup */ 426 ret = tpm_tis_spi_cancel(dev); 427 if (ret) { 428 log(LOGC_NONE, LOGL_ERR, 429 "%s: Could not cancel previous operation\n", 430 __func__); 431 goto out_err; 432 } 433 434 ret = tpm_tis_spi_wait_for_stat(dev, TPM_STS_COMMAND_READY, 435 chip->timeout_b, &status); 436 if (ret < 0 || !(status & TPM_STS_COMMAND_READY)) { 437 log(LOGC_NONE, LOGL_ERR, 438 "status %d after wait for stat returned %d\n", 439 status, ret); 440 goto out_err; 441 } 442 } 443 444 for (i = 0; i < len - 1;) { 445 burstcnt = tpm_tis_spi_get_burstcount(dev); 446 if (burstcnt < 0) 447 return burstcnt; 448 449 size = min_t(int, len - i - 1, burstcnt); 450 ret = tpm_tis_spi_write(dev, TPM_DATA_FIFO(chip->locality), 451 buf + i, size); 452 if (ret < 0) 453 goto out_err; 454 455 i += size; 456 } 457 458 ret = tpm_tis_spi_status(dev, &status); 459 if (ret) 460 goto out_err; 461 462 if ((status & TPM_STS_DATA_EXPECT) == 0) { 463 ret = -EIO; 464 goto out_err; 465 } 466 467 ret = tpm_tis_spi_write(dev, TPM_DATA_FIFO(chip->locality), 468 buf + len - 1, 1); 469 if (ret) 470 goto out_err; 471 472 ret = tpm_tis_spi_status(dev, &status); 473 if (ret) 474 goto out_err; 475 476 if ((status & TPM_STS_DATA_EXPECT) != 0) { 477 ret = -EIO; 478 goto out_err; 479 } 480 481 data = TPM_STS_GO; 482 ret = tpm_tis_spi_write(dev, TPM_STS(chip->locality), &data, 1); 483 if (ret) 484 goto out_err; 485 486 return len; 487 488 out_err: 489 tpm_tis_spi_cancel(dev); 490 tpm_tis_spi_release_locality(dev, chip->locality, false); 491 492 return ret; 493 } 494 495 static int tpm_tis_spi_cleanup(struct udevice *dev) 496 { 497 struct tpm_chip *chip = dev_get_priv(dev); 498 499 tpm_tis_spi_cancel(dev); 500 /* 501 * The TPM needs some time to clean up here, 502 * so we sleep rather than keeping the bus busy 503 */ 504 mdelay(2); 505 tpm_tis_spi_release_locality(dev, chip->locality, false); 506 507 return 0; 508 } 509 510 static int tpm_tis_spi_open(struct udevice *dev) 511 { 512 struct tpm_chip *chip = dev_get_priv(dev); 513 struct tpm_chip_priv *priv = dev_get_uclass_priv(dev); 514 515 if (chip->is_open) 516 return -EBUSY; 517 518 chip->is_open = 1; 519 520 return 0; 521 } 522 523 static int tpm_tis_spi_close(struct udevice *dev) 524 { 525 struct tpm_chip *chip = dev_get_priv(dev); 526 527 if (chip->is_open) { 528 tpm_tis_spi_release_locality(dev, chip->locality, true); 529 chip->is_open = 0; 530 } 531 532 return 0; 533 } 534 535 static int tpm_tis_get_desc(struct udevice *dev, char *buf, int size) 536 { 537 struct tpm_chip *chip = dev_get_priv(dev); 538 539 if (size < 80) 540 return -ENOSPC; 541 542 return snprintf(buf, size, 543 "%s v2.0: VendorID 0x%04x, DeviceID 0x%04x, RevisionID 0x%02x [%s]", 544 dev->name, chip->vend_dev & 0xFFFF, 545 chip->vend_dev >> 16, chip->rid, 546 (chip->is_open ? "open" : "closed")); 547 } 548 549 static int tpm_tis_wait_init(struct udevice *dev, int loc) 550 { 551 struct tpm_chip *chip = dev_get_priv(dev); 552 unsigned long start, stop; 553 u8 status; 554 int ret; 555 556 start = get_timer(0); 557 stop = chip->timeout_b; 558 do { 559 mdelay(TPM_TIMEOUT_MS); 560 561 ret = tpm_tis_spi_read(dev, TPM_ACCESS(loc), &status, 1); 562 if (ret) 563 break; 564 565 if (status & TPM_ACCESS_VALID) 566 return 0; 567 } while (get_timer(start) < stop); 568 569 return -EIO; 570 } 571 572 static int tpm_tis_spi_probe(struct udevice *dev) 573 { 574 struct tpm_tis_chip_data *drv_data = (void *)dev_get_driver_data(dev); 575 struct tpm_chip_priv *priv = dev_get_uclass_priv(dev); 576 struct tpm_chip *chip = dev_get_priv(dev); 577 int ret; 578 579 /* Use the TPM v2 stack */ 580 priv->version = TPM_V2; 581 582 if (IS_ENABLED(CONFIG_DM_GPIO)) { 583 struct gpio_desc reset_gpio; 584 585 ret = gpio_request_by_name(dev, "gpio-reset", 0, 586 &reset_gpio, GPIOD_IS_OUT); 587 if (ret) { 588 log(LOGC_NONE, LOGL_NOTICE, "%s: missing reset GPIO\n", 589 __func__); 590 } else { 591 dm_gpio_set_value(&reset_gpio, 0); 592 mdelay(1); 593 dm_gpio_set_value(&reset_gpio, 1); 594 } 595 } 596 597 /* Ensure a minimum amount of time elapsed since reset of the TPM */ 598 mdelay(drv_data->time_before_first_cmd_ms); 599 600 chip->locality = 0; 601 chip->timeout_a = TIS_SHORT_TIMEOUT_MS; 602 chip->timeout_b = TIS_LONG_TIMEOUT_MS; 603 chip->timeout_c = TIS_SHORT_TIMEOUT_MS; 604 chip->timeout_d = TIS_SHORT_TIMEOUT_MS; 605 priv->pcr_count = drv_data->pcr_count; 606 priv->pcr_select_min = drv_data->pcr_select_min; 607 608 ret = tpm_tis_wait_init(dev, chip->locality); 609 if (ret) { 610 log(LOGC_DM, LOGL_ERR, "%s: no device found\n", __func__); 611 return ret; 612 } 613 614 ret = tpm_tis_spi_request_locality(dev, chip->locality); 615 if (ret) { 616 log(LOGC_NONE, LOGL_ERR, "%s: could not request locality %d\n", 617 __func__, chip->locality); 618 return ret; 619 } 620 621 ret = tpm_tis_spi_read32(dev, TPM_DID_VID(chip->locality), 622 &chip->vend_dev); 623 if (ret) { 624 log(LOGC_NONE, LOGL_ERR, 625 "%s: could not retrieve VendorID/DeviceID\n", __func__); 626 return ret; 627 } 628 629 ret = tpm_tis_spi_read(dev, TPM_RID(chip->locality), &chip->rid, 1); 630 if (ret) { 631 log(LOGC_NONE, LOGL_ERR, "%s: could not retrieve RevisionID\n", 632 __func__); 633 return ret; 634 } 635 636 log(LOGC_NONE, LOGL_ERR, 637 "SPI TPMv2.0 found (vid:%04x, did:%04x, rid:%02x)\n", 638 chip->vend_dev & 0xFFFF, chip->vend_dev >> 16, chip->rid); 639 640 return 0; 641 } 642 643 static int tpm_tis_spi_remove(struct udevice *dev) 644 { 645 struct tpm_chip *chip = dev_get_priv(dev); 646 647 tpm_tis_spi_release_locality(dev, chip->locality, true); 648 649 return 0; 650 } 651 652 static const struct tpm_ops tpm_tis_spi_ops = { 653 .open = tpm_tis_spi_open, 654 .close = tpm_tis_spi_close, 655 .get_desc = tpm_tis_get_desc, 656 .send = tpm_tis_spi_send, 657 .recv = tpm_tis_spi_recv, 658 .cleanup = tpm_tis_spi_cleanup, 659 }; 660 661 static const struct tpm_tis_chip_data tpm_tis_std_chip_data = { 662 .pcr_count = 24, 663 .pcr_select_min = 3, 664 .time_before_first_cmd_ms = 30, 665 }; 666 667 static const struct udevice_id tpm_tis_spi_ids[] = { 668 { 669 .compatible = "tis,tpm2-spi", 670 .data = (ulong)&tpm_tis_std_chip_data, 671 }, 672 { } 673 }; 674 675 U_BOOT_DRIVER(tpm_tis_spi) = { 676 .name = "tpm_tis_spi", 677 .id = UCLASS_TPM, 678 .of_match = tpm_tis_spi_ids, 679 .ops = &tpm_tis_spi_ops, 680 .probe = tpm_tis_spi_probe, 681 .remove = tpm_tis_spi_remove, 682 .priv_auto_alloc_size = sizeof(struct tpm_chip), 683 }; 684