1 /* 2 * Copyright (c) 2011 The Chromium OS Authors. 3 * 4 * SPDX-License-Identifier: GPL-2.0+ 5 */ 6 7 /* 8 * The code in this file is based on the article "Writing a TPM Device Driver" 9 * published on http://ptgmedia.pearsoncmg.com. 10 * 11 * One principal difference is that in the simplest config the other than 0 12 * TPM localities do not get mapped by some devices (for instance, by Infineon 13 * slb9635), so this driver provides access to locality 0 only. 14 */ 15 16 #include <common.h> 17 #include <asm/io.h> 18 #include <tpm.h> 19 20 #define PREFIX "lpc_tpm: " 21 22 struct tpm_locality { 23 u32 access; 24 u8 padding0[4]; 25 u32 int_enable; 26 u8 vector; 27 u8 padding1[3]; 28 u32 int_status; 29 u32 int_capability; 30 u32 tpm_status; 31 u8 padding2[8]; 32 u8 data; 33 u8 padding3[3803]; 34 u32 did_vid; 35 u8 rid; 36 u8 padding4[251]; 37 }; 38 39 /* 40 * This pointer refers to the TPM chip, 5 of its localities are mapped as an 41 * array. 42 */ 43 #define TPM_TOTAL_LOCALITIES 5 44 static struct tpm_locality *lpc_tpm_dev = 45 (struct tpm_locality *)CONFIG_TPM_TIS_BASE_ADDRESS; 46 47 /* Some registers' bit field definitions */ 48 #define TIS_STS_VALID (1 << 7) /* 0x80 */ 49 #define TIS_STS_COMMAND_READY (1 << 6) /* 0x40 */ 50 #define TIS_STS_TPM_GO (1 << 5) /* 0x20 */ 51 #define TIS_STS_DATA_AVAILABLE (1 << 4) /* 0x10 */ 52 #define TIS_STS_EXPECT (1 << 3) /* 0x08 */ 53 #define TIS_STS_RESPONSE_RETRY (1 << 1) /* 0x02 */ 54 55 #define TIS_ACCESS_TPM_REG_VALID_STS (1 << 7) /* 0x80 */ 56 #define TIS_ACCESS_ACTIVE_LOCALITY (1 << 5) /* 0x20 */ 57 #define TIS_ACCESS_BEEN_SEIZED (1 << 4) /* 0x10 */ 58 #define TIS_ACCESS_SEIZE (1 << 3) /* 0x08 */ 59 #define TIS_ACCESS_PENDING_REQUEST (1 << 2) /* 0x04 */ 60 #define TIS_ACCESS_REQUEST_USE (1 << 1) /* 0x02 */ 61 #define TIS_ACCESS_TPM_ESTABLISHMENT (1 << 0) /* 0x01 */ 62 63 #define TIS_STS_BURST_COUNT_MASK (0xffff) 64 #define TIS_STS_BURST_COUNT_SHIFT (8) 65 66 /* 67 * Error value returned if a tpm register does not enter the expected state 68 * after continuous polling. No actual TPM register reading ever returns -1, 69 * so this value is a safe error indication to be mixed with possible status 70 * register values. 71 */ 72 #define TPM_TIMEOUT_ERR (-1) 73 74 /* Error value returned on various TPM driver errors. */ 75 #define TPM_DRIVER_ERR (1) 76 77 /* 1 second is plenty for anything TPM does. */ 78 #define MAX_DELAY_US (1000 * 1000) 79 80 /* Retrieve burst count value out of the status register contents. */ 81 static u16 burst_count(u32 status) 82 { 83 return (status >> TIS_STS_BURST_COUNT_SHIFT) & TIS_STS_BURST_COUNT_MASK; 84 } 85 86 /* 87 * Structures defined below allow creating descriptions of TPM vendor/device 88 * ID information for run time discovery. The only device the system knows 89 * about at this time is Infineon slb9635. 90 */ 91 struct device_name { 92 u16 dev_id; 93 const char * const dev_name; 94 }; 95 96 struct vendor_name { 97 u16 vendor_id; 98 const char *vendor_name; 99 const struct device_name *dev_names; 100 }; 101 102 static const struct device_name infineon_devices[] = { 103 {0xb, "SLB9635 TT 1.2"}, 104 {0} 105 }; 106 107 static const struct vendor_name vendor_names[] = { 108 {0x15d1, "Infineon", infineon_devices}, 109 }; 110 111 /* 112 * Cached vendor/device ID pair to indicate that the device has been already 113 * discovered. 114 */ 115 static u32 vendor_dev_id; 116 117 /* TPM access wrappers to support tracing */ 118 static u8 tpm_read_byte(const u8 *ptr) 119 { 120 u8 ret = readb(ptr); 121 debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n", 122 (u32)(uintptr_t)ptr - (u32)(uintptr_t)lpc_tpm_dev, ret); 123 return ret; 124 } 125 126 static u32 tpm_read_word(const u32 *ptr) 127 { 128 u32 ret = readl(ptr); 129 debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n", 130 (u32)(uintptr_t)ptr - (u32)(uintptr_t)lpc_tpm_dev, ret); 131 return ret; 132 } 133 134 static void tpm_write_byte(u8 value, u8 *ptr) 135 { 136 debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n", 137 (u32)(uintptr_t)ptr - (u32)(uintptr_t)lpc_tpm_dev, value); 138 writeb(value, ptr); 139 } 140 141 static void tpm_write_word(u32 value, u32 *ptr) 142 { 143 debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n", 144 (u32)(uintptr_t)ptr - (u32)(uintptr_t)lpc_tpm_dev, value); 145 writel(value, ptr); 146 } 147 148 /* 149 * tis_wait_reg() 150 * 151 * Wait for at least a second for a register to change its state to match the 152 * expected state. Normally the transition happens within microseconds. 153 * 154 * @reg - pointer to the TPM register 155 * @mask - bitmask for the bitfield(s) to watch 156 * @expected - value the field(s) are supposed to be set to 157 * 158 * Returns the register contents in case the expected value was found in the 159 * appropriate register bits, or TPM_TIMEOUT_ERR on timeout. 160 */ 161 static u32 tis_wait_reg(u32 *reg, u8 mask, u8 expected) 162 { 163 u32 time_us = MAX_DELAY_US; 164 165 while (time_us > 0) { 166 u32 value = tpm_read_word(reg); 167 if ((value & mask) == expected) 168 return value; 169 udelay(1); /* 1 us */ 170 time_us--; 171 } 172 return TPM_TIMEOUT_ERR; 173 } 174 175 /* 176 * Probe the TPM device and try determining its manufacturer/device name. 177 * 178 * Returns 0 on success (the device is found or was found during an earlier 179 * invocation) or TPM_DRIVER_ERR if the device is not found. 180 */ 181 int tis_init(void) 182 { 183 u32 didvid = tpm_read_word(&lpc_tpm_dev[0].did_vid); 184 int i; 185 const char *device_name = "unknown"; 186 const char *vendor_name = device_name; 187 u16 vid, did; 188 189 if (vendor_dev_id) 190 return 0; /* Already probed. */ 191 192 if (!didvid || (didvid == 0xffffffff)) { 193 printf("%s: No TPM device found\n", __func__); 194 return TPM_DRIVER_ERR; 195 } 196 197 vendor_dev_id = didvid; 198 199 vid = didvid & 0xffff; 200 did = (didvid >> 16) & 0xffff; 201 for (i = 0; i < ARRAY_SIZE(vendor_names); i++) { 202 int j = 0; 203 u16 known_did; 204 205 if (vid == vendor_names[i].vendor_id) 206 vendor_name = vendor_names[i].vendor_name; 207 208 while ((known_did = vendor_names[i].dev_names[j].dev_id) != 0) { 209 if (known_did == did) { 210 device_name = 211 vendor_names[i].dev_names[j].dev_name; 212 break; 213 } 214 j++; 215 } 216 break; 217 } 218 219 printf("Found TPM %s by %s\n", device_name, vendor_name); 220 return 0; 221 } 222 223 /* 224 * tis_senddata() 225 * 226 * send the passed in data to the TPM device. 227 * 228 * @data - address of the data to send, byte by byte 229 * @len - length of the data to send 230 * 231 * Returns 0 on success, TPM_DRIVER_ERR on error (in case the device does 232 * not accept the entire command). 233 */ 234 static u32 tis_senddata(const u8 * const data, u32 len) 235 { 236 u32 offset = 0; 237 u16 burst = 0; 238 u32 max_cycles = 0; 239 u8 locality = 0; 240 u32 value; 241 242 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status, 243 TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY); 244 if (value == TPM_TIMEOUT_ERR) { 245 printf("%s:%d - failed to get 'command_ready' status\n", 246 __FILE__, __LINE__); 247 return TPM_DRIVER_ERR; 248 } 249 burst = burst_count(value); 250 251 while (1) { 252 unsigned count; 253 254 /* Wait till the device is ready to accept more data. */ 255 while (!burst) { 256 if (max_cycles++ == MAX_DELAY_US) { 257 printf("%s:%d failed to feed %d bytes of %d\n", 258 __FILE__, __LINE__, len - offset, len); 259 return TPM_DRIVER_ERR; 260 } 261 udelay(1); 262 burst = burst_count(tpm_read_word(&lpc_tpm_dev 263 [locality].tpm_status)); 264 } 265 266 max_cycles = 0; 267 268 /* 269 * Calculate number of bytes the TPM is ready to accept in one 270 * shot. 271 * 272 * We want to send the last byte outside of the loop (hence 273 * the -1 below) to make sure that the 'expected' status bit 274 * changes to zero exactly after the last byte is fed into the 275 * FIFO. 276 */ 277 count = min((u32)burst, len - offset - 1); 278 while (count--) 279 tpm_write_byte(data[offset++], 280 &lpc_tpm_dev[locality].data); 281 282 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status, 283 TIS_STS_VALID, TIS_STS_VALID); 284 285 if ((value == TPM_TIMEOUT_ERR) || !(value & TIS_STS_EXPECT)) { 286 printf("%s:%d TPM command feed overflow\n", 287 __FILE__, __LINE__); 288 return TPM_DRIVER_ERR; 289 } 290 291 burst = burst_count(value); 292 if ((offset == (len - 1)) && burst) { 293 /* 294 * We need to be able to send the last byte to the 295 * device, so burst size must be nonzero before we 296 * break out. 297 */ 298 break; 299 } 300 } 301 302 /* Send the last byte. */ 303 tpm_write_byte(data[offset++], &lpc_tpm_dev[locality].data); 304 /* 305 * Verify that TPM does not expect any more data as part of this 306 * command. 307 */ 308 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status, 309 TIS_STS_VALID, TIS_STS_VALID); 310 if ((value == TPM_TIMEOUT_ERR) || (value & TIS_STS_EXPECT)) { 311 printf("%s:%d unexpected TPM status 0x%x\n", 312 __FILE__, __LINE__, value); 313 return TPM_DRIVER_ERR; 314 } 315 316 /* OK, sitting pretty, let's start the command execution. */ 317 tpm_write_word(TIS_STS_TPM_GO, &lpc_tpm_dev[locality].tpm_status); 318 return 0; 319 } 320 321 /* 322 * tis_readresponse() 323 * 324 * read the TPM device response after a command was issued. 325 * 326 * @buffer - address where to read the response, byte by byte. 327 * @len - pointer to the size of buffer 328 * 329 * On success stores the number of received bytes to len and returns 0. On 330 * errors (misformatted TPM data or synchronization problems) returns 331 * TPM_DRIVER_ERR. 332 */ 333 static u32 tis_readresponse(u8 *buffer, u32 *len) 334 { 335 u16 burst; 336 u32 value; 337 u32 offset = 0; 338 u8 locality = 0; 339 const u32 has_data = TIS_STS_DATA_AVAILABLE | TIS_STS_VALID; 340 u32 expected_count = *len; 341 int max_cycles = 0; 342 343 /* Wait for the TPM to process the command. */ 344 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status, 345 has_data, has_data); 346 if (value == TPM_TIMEOUT_ERR) { 347 printf("%s:%d failed processing command\n", 348 __FILE__, __LINE__); 349 return TPM_DRIVER_ERR; 350 } 351 352 do { 353 while ((burst = burst_count(value)) == 0) { 354 if (max_cycles++ == MAX_DELAY_US) { 355 printf("%s:%d TPM stuck on read\n", 356 __FILE__, __LINE__); 357 return TPM_DRIVER_ERR; 358 } 359 udelay(1); 360 value = tpm_read_word(&lpc_tpm_dev 361 [locality].tpm_status); 362 } 363 364 max_cycles = 0; 365 366 while (burst-- && (offset < expected_count)) { 367 buffer[offset++] = tpm_read_byte(&lpc_tpm_dev 368 [locality].data); 369 370 if (offset == 6) { 371 /* 372 * We got the first six bytes of the reply, 373 * let's figure out how many bytes to expect 374 * total - it is stored as a 4 byte number in 375 * network order, starting with offset 2 into 376 * the body of the reply. 377 */ 378 u32 real_length; 379 memcpy(&real_length, 380 buffer + 2, 381 sizeof(real_length)); 382 expected_count = be32_to_cpu(real_length); 383 384 if ((expected_count < offset) || 385 (expected_count > *len)) { 386 printf("%s:%d bad response size %d\n", 387 __FILE__, __LINE__, 388 expected_count); 389 return TPM_DRIVER_ERR; 390 } 391 } 392 } 393 394 /* Wait for the next portion. */ 395 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status, 396 TIS_STS_VALID, TIS_STS_VALID); 397 if (value == TPM_TIMEOUT_ERR) { 398 printf("%s:%d failed to read response\n", 399 __FILE__, __LINE__); 400 return TPM_DRIVER_ERR; 401 } 402 403 if (offset == expected_count) 404 break; /* We got all we needed. */ 405 406 } while ((value & has_data) == has_data); 407 408 /* 409 * Make sure we indeed read all there was. The TIS_STS_VALID bit is 410 * known to be set. 411 */ 412 if (value & TIS_STS_DATA_AVAILABLE) { 413 printf("%s:%d wrong receive status %x\n", 414 __FILE__, __LINE__, value); 415 return TPM_DRIVER_ERR; 416 } 417 418 /* Tell the TPM that we are done. */ 419 tpm_write_word(TIS_STS_COMMAND_READY, &lpc_tpm_dev 420 [locality].tpm_status); 421 *len = offset; 422 return 0; 423 } 424 425 int tis_open(void) 426 { 427 u8 locality = 0; /* we use locality zero for everything. */ 428 429 if (tis_close()) 430 return TPM_DRIVER_ERR; 431 432 /* now request access to locality. */ 433 tpm_write_word(TIS_ACCESS_REQUEST_USE, &lpc_tpm_dev[locality].access); 434 435 /* did we get a lock? */ 436 if (tis_wait_reg(&lpc_tpm_dev[locality].access, 437 TIS_ACCESS_ACTIVE_LOCALITY, 438 TIS_ACCESS_ACTIVE_LOCALITY) == TPM_TIMEOUT_ERR) { 439 printf("%s:%d - failed to lock locality %d\n", 440 __FILE__, __LINE__, locality); 441 return TPM_DRIVER_ERR; 442 } 443 444 tpm_write_word(TIS_STS_COMMAND_READY, 445 &lpc_tpm_dev[locality].tpm_status); 446 return 0; 447 } 448 449 int tis_close(void) 450 { 451 u8 locality = 0; 452 453 if (tpm_read_word(&lpc_tpm_dev[locality].access) & 454 TIS_ACCESS_ACTIVE_LOCALITY) { 455 tpm_write_word(TIS_ACCESS_ACTIVE_LOCALITY, 456 &lpc_tpm_dev[locality].access); 457 458 if (tis_wait_reg(&lpc_tpm_dev[locality].access, 459 TIS_ACCESS_ACTIVE_LOCALITY, 0) == 460 TPM_TIMEOUT_ERR) { 461 printf("%s:%d - failed to release locality %d\n", 462 __FILE__, __LINE__, locality); 463 return TPM_DRIVER_ERR; 464 } 465 } 466 return 0; 467 } 468 469 int tis_sendrecv(const u8 *sendbuf, size_t send_size, 470 u8 *recvbuf, size_t *recv_len) 471 { 472 if (tis_senddata(sendbuf, send_size)) { 473 printf("%s:%d failed sending data to TPM\n", 474 __FILE__, __LINE__); 475 return TPM_DRIVER_ERR; 476 } 477 478 return tis_readresponse(recvbuf, (u32 *)recv_len); 479 } 480