1 /* 2 * STMicroelectronics TPM ST33ZP24 SPI UBOOT driver 3 * 4 * Copyright (C) 2016, STMicroelectronics - All Rights Reserved 5 * Author(s): Christophe Ricard <christophe-h.ricard@st.com> for STMicroelectronics. 6 * 7 * Description: Device driver for ST33ZP24 SPI TPM TCG. 8 * 9 * This device driver implements the TPM interface as defined in 10 * the TCG TPM Interface Spec version 1.21, revision 1.0 and the 11 * STMicroelectronics Protocol Stack Specification version 1.2.0. 12 * 13 * SPDX-License-Identifier: GPL-2.0+ 14 */ 15 16 #include <common.h> 17 #include <dm.h> 18 #include <fdtdec.h> 19 #include <spi.h> 20 #include <tpm.h> 21 #include <errno.h> 22 #include <linux/types.h> 23 #include <asm/unaligned.h> 24 #include <linux/compat.h> 25 26 #include "tpm_tis.h" 27 #include "tpm_internal.h" 28 29 #define TPM_ACCESS 0x0 30 #define TPM_STS 0x18 31 #define TPM_DATA_FIFO 0x24 32 33 #define LOCALITY0 0 34 35 #define TPM_DATA_FIFO 0x24 36 #define TPM_INTF_CAPABILITY 0x14 37 38 #define TPM_DUMMY_BYTE 0x00 39 #define TPM_WRITE_DIRECTION 0x80 40 41 #define MAX_SPI_LATENCY 15 42 #define LOCALITY0 0 43 44 #define ST33ZP24_OK 0x5A 45 #define ST33ZP24_UNDEFINED_ERR 0x80 46 #define ST33ZP24_BADLOCALITY 0x81 47 #define ST33ZP24_TISREGISTER_UKNOWN 0x82 48 #define ST33ZP24_LOCALITY_NOT_ACTIVATED 0x83 49 #define ST33ZP24_HASH_END_BEFORE_HASH_START 0x84 50 #define ST33ZP24_BAD_COMMAND_ORDER 0x85 51 #define ST33ZP24_INCORECT_RECEIVED_LENGTH 0x86 52 #define ST33ZP24_TPM_FIFO_OVERFLOW 0x89 53 #define ST33ZP24_UNEXPECTED_READ_FIFO 0x8A 54 #define ST33ZP24_UNEXPECTED_WRITE_FIFO 0x8B 55 #define ST33ZP24_CMDRDY_SET_WHEN_PROCESSING_HASH_END 0x90 56 #define ST33ZP24_DUMMY_BYTES 0x00 57 58 /* 59 * TPM command can be up to 2048 byte, A TPM response can be up to 60 * 1024 byte. 61 * Between command and response, there are latency byte (up to 15 62 * usually on st33zp24 2 are enough). 63 * 64 * Overall when sending a command and expecting an answer we need if 65 * worst case: 66 * 2048 (for the TPM command) + 1024 (for the TPM answer). We need 67 * some latency byte before the answer is available (max 15). 68 * We have 2048 + 1024 + 15. 69 */ 70 #define ST33ZP24_SPI_BUFFER_SIZE (TPM_BUFSIZE + (TPM_BUFSIZE / 2) +\ 71 MAX_SPI_LATENCY) 72 73 struct st33zp24_spi_phy { 74 int latency; 75 76 u8 tx_buf[ST33ZP24_SPI_BUFFER_SIZE]; 77 u8 rx_buf[ST33ZP24_SPI_BUFFER_SIZE]; 78 }; 79 80 static int st33zp24_spi_status_to_errno(u8 code) 81 { 82 switch (code) { 83 case ST33ZP24_OK: 84 return 0; 85 case ST33ZP24_UNDEFINED_ERR: 86 case ST33ZP24_BADLOCALITY: 87 case ST33ZP24_TISREGISTER_UKNOWN: 88 case ST33ZP24_LOCALITY_NOT_ACTIVATED: 89 case ST33ZP24_HASH_END_BEFORE_HASH_START: 90 case ST33ZP24_BAD_COMMAND_ORDER: 91 case ST33ZP24_UNEXPECTED_READ_FIFO: 92 case ST33ZP24_UNEXPECTED_WRITE_FIFO: 93 case ST33ZP24_CMDRDY_SET_WHEN_PROCESSING_HASH_END: 94 return -EPROTO; 95 case ST33ZP24_INCORECT_RECEIVED_LENGTH: 96 case ST33ZP24_TPM_FIFO_OVERFLOW: 97 return -EMSGSIZE; 98 case ST33ZP24_DUMMY_BYTES: 99 return -ENOSYS; 100 } 101 return code; 102 } 103 104 /* 105 * st33zp24_spi_send 106 * Send byte to TPM register according to the ST33ZP24 SPI protocol. 107 * @param: tpm, the chip description 108 * @param: tpm_register, the tpm tis register where the data should be written 109 * @param: tpm_data, the tpm_data to write inside the tpm_register 110 * @param: tpm_size, The length of the data 111 * @return: should be zero if success else a negative error code. 112 */ 113 static int st33zp24_spi_write(struct udevice *dev, u8 tpm_register, 114 const u8 *tpm_data, size_t tpm_size) 115 { 116 int total_length = 0, ret; 117 struct spi_slave *slave = dev_get_parent_priv(dev); 118 struct st33zp24_spi_phy *phy = dev_get_platdata(dev); 119 120 u8 *tx_buf = (u8 *)phy->tx_buf; 121 u8 *rx_buf = phy->rx_buf; 122 123 tx_buf[total_length++] = TPM_WRITE_DIRECTION | LOCALITY0; 124 tx_buf[total_length++] = tpm_register; 125 126 if (tpm_size > 0 && tpm_register == TPM_DATA_FIFO) { 127 tx_buf[total_length++] = tpm_size >> 8; 128 tx_buf[total_length++] = tpm_size; 129 } 130 memcpy(tx_buf + total_length, tpm_data, tpm_size); 131 total_length += tpm_size; 132 133 memset(tx_buf + total_length, TPM_DUMMY_BYTE, phy->latency); 134 135 total_length += phy->latency; 136 137 ret = spi_claim_bus(slave); 138 if (ret < 0) 139 return ret; 140 141 ret = spi_xfer(slave, total_length * 8, tx_buf, rx_buf, 142 SPI_XFER_BEGIN | SPI_XFER_END); 143 if (ret < 0) 144 return ret; 145 146 spi_release_bus(slave); 147 148 if (ret == 0) 149 ret = rx_buf[total_length - 1]; 150 151 return st33zp24_spi_status_to_errno(ret); 152 } 153 154 /* 155 * spi_st33zp24_spi_read8_reg 156 * Recv byte from the TIS register according to the ST33ZP24 SPI protocol. 157 * @param: tpm, the chip description 158 * @param: tpm_loc, the locality to read register from 159 * @param: tpm_register, the tpm tis register where the data should be read 160 * @param: tpm_data, the TPM response 161 * @param: tpm_size, tpm TPM response size to read. 162 * @return: should be zero if success else a negative error code. 163 */ 164 static u8 st33zp24_spi_read8_reg(struct udevice *dev, u8 tpm_register, 165 u8 *tpm_data, size_t tpm_size) 166 { 167 int total_length = 0, ret; 168 struct spi_slave *slave = dev_get_parent_priv(dev); 169 struct st33zp24_spi_phy *phy = dev_get_platdata(dev); 170 171 u8 *tx_buf = (u8 *)phy->tx_buf; 172 u8 *rx_buf = phy->rx_buf; 173 174 /* Pre-Header */ 175 tx_buf[total_length++] = LOCALITY0; 176 tx_buf[total_length++] = tpm_register; 177 178 memset(&tx_buf[total_length], TPM_DUMMY_BYTE, 179 phy->latency + tpm_size); 180 total_length += phy->latency + tpm_size; 181 182 ret = spi_claim_bus(slave); 183 if (ret < 0) 184 return 0; 185 186 ret = spi_xfer(slave, total_length * 8, tx_buf, rx_buf, 187 SPI_XFER_BEGIN | SPI_XFER_END); 188 if (ret < 0) 189 return 0; 190 191 spi_release_bus(slave); 192 193 if (tpm_size > 0 && ret == 0) { 194 ret = rx_buf[total_length - tpm_size - 1]; 195 memcpy(tpm_data, rx_buf + total_length - tpm_size, tpm_size); 196 } 197 return ret; 198 } 199 200 /* 201 * st33zp24_spi_recv 202 * Recv byte from the TIS register according to the ST33ZP24 SPI protocol. 203 * @param: phy_id, the phy description 204 * @param: tpm_register, the tpm tis register where the data should be read 205 * @param: tpm_data, the TPM response 206 * @param: tpm_size, tpm TPM response size to read. 207 * @return: number of byte read successfully: should be one if success. 208 */ 209 static int st33zp24_spi_read(struct udevice *dev, u8 tpm_register, 210 u8 *tpm_data, size_t tpm_size) 211 { 212 int ret; 213 214 ret = st33zp24_spi_read8_reg(dev, tpm_register, tpm_data, tpm_size); 215 if (!st33zp24_spi_status_to_errno(ret)) 216 return tpm_size; 217 218 return ret; 219 } 220 221 static int st33zp24_spi_evaluate_latency(struct udevice *dev) 222 { 223 int latency = 1, status = 0; 224 u8 data = 0; 225 struct st33zp24_spi_phy *phy = dev_get_platdata(dev); 226 227 while (!status && latency < MAX_SPI_LATENCY) { 228 phy->latency = latency; 229 status = st33zp24_spi_read8_reg(dev, TPM_INTF_CAPABILITY, 230 &data, 1); 231 latency++; 232 } 233 if (status < 0) 234 return status; 235 if (latency == MAX_SPI_LATENCY) 236 return -ENODEV; 237 238 return latency - 1; 239 } 240 241 /* 242 * st33zp24_spi_release_locality release the active locality 243 * @param: chip, the tpm chip description. 244 */ 245 static void st33zp24_spi_release_locality(struct udevice *dev) 246 { 247 u8 data = TPM_ACCESS_ACTIVE_LOCALITY; 248 249 st33zp24_spi_write(dev, TPM_ACCESS, &data, 1); 250 } 251 252 /* 253 * st33zp24_spi_check_locality if the locality is active 254 * @param: chip, the tpm chip description 255 * @return: the active locality or -EACCES. 256 */ 257 static int st33zp24_spi_check_locality(struct udevice *dev) 258 { 259 u8 data; 260 u8 status; 261 struct tpm_chip *chip = dev_get_priv(dev); 262 263 status = st33zp24_spi_read(dev, TPM_ACCESS, &data, 1); 264 if (status && (data & 265 (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) == 266 (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) 267 return chip->locality; 268 269 return -EACCES; 270 } 271 272 /* 273 * st33zp24_spi_request_locality request the TPM locality 274 * @param: chip, the chip description 275 * @return: the active locality or negative value. 276 */ 277 static int st33zp24_spi_request_locality(struct udevice *dev) 278 { 279 unsigned long start, stop; 280 long ret; 281 u8 data; 282 struct tpm_chip *chip = dev_get_priv(dev); 283 284 if (st33zp24_spi_check_locality(dev) == chip->locality) 285 return chip->locality; 286 287 data = TPM_ACCESS_REQUEST_USE; 288 ret = st33zp24_spi_write(dev, TPM_ACCESS, &data, 1); 289 if (ret < 0) 290 return ret; 291 292 /* wait for locality activated */ 293 start = get_timer(0); 294 stop = chip->timeout_a; 295 do { 296 if (st33zp24_spi_check_locality(dev) >= 0) 297 return chip->locality; 298 udelay(TPM_TIMEOUT_MS * 1000); 299 } while (get_timer(start) < stop); 300 301 return -EACCES; 302 } 303 304 /* 305 * st33zp24_spi_status return the TPM_STS register 306 * @param: chip, the tpm chip description 307 * @return: the TPM_STS register value. 308 */ 309 static u8 st33zp24_spi_status(struct udevice *dev) 310 { 311 u8 data; 312 313 st33zp24_spi_read(dev, TPM_STS, &data, 1); 314 return data; 315 } 316 317 /* 318 * st33zp24_spi_get_burstcount return the burstcount address 0x19 0x1A 319 * @param: chip, the chip description 320 * return: the burstcount or -TPM_DRIVER_ERR in case of error. 321 */ 322 static int st33zp24_spi_get_burstcount(struct udevice *dev) 323 { 324 struct tpm_chip *chip = dev_get_priv(dev); 325 unsigned long start, stop; 326 int burstcnt, status; 327 u8 tpm_reg, temp; 328 329 /* wait for burstcount */ 330 start = get_timer(0); 331 stop = chip->timeout_d; 332 do { 333 tpm_reg = TPM_STS + 1; 334 status = st33zp24_spi_read(dev, tpm_reg, &temp, 1); 335 if (status < 0) 336 return -EBUSY; 337 338 tpm_reg = TPM_STS + 2; 339 burstcnt = temp; 340 status = st33zp24_spi_read(dev, tpm_reg, &temp, 1); 341 if (status < 0) 342 return -EBUSY; 343 344 burstcnt |= temp << 8; 345 if (burstcnt) 346 return burstcnt; 347 udelay(TIS_SHORT_TIMEOUT_MS * 1000); 348 } while (get_timer(start) < stop); 349 350 return -EBUSY; 351 } 352 353 /* 354 * st33zp24_spi_cancel, cancel the current command execution or 355 * set STS to COMMAND READY. 356 * @param: chip, tpm_chip description. 357 */ 358 static void st33zp24_spi_cancel(struct udevice *dev) 359 { 360 u8 data; 361 362 data = TPM_STS_COMMAND_READY; 363 st33zp24_spi_write(dev, TPM_STS, &data, 1); 364 } 365 366 /* 367 * st33zp24_spi_wait_for_stat wait for a TPM_STS value 368 * @param: chip, the tpm chip description 369 * @param: mask, the value mask to wait 370 * @param: timeout, the timeout 371 * @param: status, 372 * @return: the tpm status, 0 if success, -ETIME if timeout is reached. 373 */ 374 static int st33zp24_spi_wait_for_stat(struct udevice *dev, u8 mask, 375 unsigned long timeout, int *status) 376 { 377 unsigned long start, stop; 378 379 /* Check current status */ 380 *status = st33zp24_spi_status(dev); 381 if ((*status & mask) == mask) 382 return 0; 383 384 start = get_timer(0); 385 stop = timeout; 386 do { 387 udelay(TPM_TIMEOUT_MS * 1000); 388 *status = st33zp24_spi_status(dev); 389 if ((*status & mask) == mask) 390 return 0; 391 } while (get_timer(start) < stop); 392 393 return -ETIME; 394 } 395 396 /* 397 * st33zp24_spi_recv_data receive data 398 * @param: chip, the tpm chip description 399 * @param: buf, the buffer where the data are received 400 * @param: count, the number of data to receive 401 * @return: the number of bytes read from TPM FIFO. 402 */ 403 static int st33zp24_spi_recv_data(struct udevice *dev, u8 *buf, size_t count) 404 { 405 struct tpm_chip *chip = dev_get_priv(dev); 406 int size = 0, burstcnt, len, ret, status; 407 408 while (size < count && 409 st33zp24_spi_wait_for_stat(dev, TPM_STS_DATA_AVAIL | TPM_STS_VALID, 410 chip->timeout_c, &status) == 0) { 411 burstcnt = st33zp24_spi_get_burstcount(dev); 412 if (burstcnt < 0) 413 return burstcnt; 414 len = min_t(int, burstcnt, count - size); 415 ret = st33zp24_spi_read(dev, TPM_DATA_FIFO, buf + size, len); 416 if (ret < 0) 417 return ret; 418 419 size += len; 420 } 421 return size; 422 } 423 424 /* 425 * st33zp24_spi_recv received TPM response through TPM phy. 426 * @param: chip, tpm_chip description. 427 * @param: buf, the buffer to store data. 428 * @param: count, the number of bytes that can received (sizeof buf). 429 * @return: Returns zero in case of success else -EIO. 430 */ 431 static int st33zp24_spi_recv(struct udevice *dev, u8 *buf, size_t count) 432 { 433 struct tpm_chip *chip = dev_get_priv(dev); 434 int size; 435 unsigned int expected; 436 437 if (!chip) 438 return -ENODEV; 439 440 if (count < TPM_HEADER_SIZE) { 441 size = -EIO; 442 goto out; 443 } 444 445 size = st33zp24_spi_recv_data(dev, buf, TPM_HEADER_SIZE); 446 if (size < TPM_HEADER_SIZE) { 447 debug("TPM error, unable to read header\n"); 448 goto out; 449 } 450 451 expected = get_unaligned_be32(buf + 2); 452 if (expected > count || expected < TPM_HEADER_SIZE) { 453 size = -EIO; 454 goto out; 455 } 456 457 size += st33zp24_spi_recv_data(dev, &buf[TPM_HEADER_SIZE], 458 expected - TPM_HEADER_SIZE); 459 if (size < expected) { 460 debug("TPM error, unable to read remaining bytes of result\n"); 461 size = -EIO; 462 goto out; 463 } 464 465 out: 466 st33zp24_spi_cancel(dev); 467 st33zp24_spi_release_locality(dev); 468 469 return size; 470 } 471 472 /* 473 * st33zp24_spi_send send TPM commands through TPM phy. 474 * @param: chip, tpm_chip description. 475 * @param: buf, the buffer to send. 476 * @param: len, the number of bytes to send. 477 * @return: Returns zero in case of success else the negative error code. 478 */ 479 static int st33zp24_spi_send(struct udevice *dev, const u8 *buf, size_t len) 480 { 481 struct tpm_chip *chip = dev_get_priv(dev); 482 u32 i, size; 483 int burstcnt, ret, status; 484 u8 data, tpm_stat; 485 486 if (!chip) 487 return -ENODEV; 488 if (len < TPM_HEADER_SIZE) 489 return -EIO; 490 491 ret = st33zp24_spi_request_locality(dev); 492 if (ret < 0) 493 return ret; 494 495 tpm_stat = st33zp24_spi_status(dev); 496 if ((tpm_stat & TPM_STS_COMMAND_READY) == 0) { 497 st33zp24_spi_cancel(dev); 498 if (st33zp24_spi_wait_for_stat(dev, TPM_STS_COMMAND_READY, 499 chip->timeout_b, &status) < 0) { 500 ret = -ETIME; 501 goto out_err; 502 } 503 } 504 505 for (i = 0; i < len - 1;) { 506 burstcnt = st33zp24_spi_get_burstcount(dev); 507 if (burstcnt < 0) 508 return burstcnt; 509 510 size = min_t(int, len - i - 1, burstcnt); 511 ret = st33zp24_spi_write(dev, TPM_DATA_FIFO, buf + i, size); 512 if (ret < 0) 513 goto out_err; 514 515 i += size; 516 } 517 518 tpm_stat = st33zp24_spi_status(dev); 519 if ((tpm_stat & TPM_STS_DATA_EXPECT) == 0) { 520 ret = -EIO; 521 goto out_err; 522 } 523 524 ret = st33zp24_spi_write(dev, TPM_DATA_FIFO, buf + len - 1, 1); 525 if (ret < 0) 526 goto out_err; 527 528 tpm_stat = st33zp24_spi_status(dev); 529 if ((tpm_stat & TPM_STS_DATA_EXPECT) != 0) { 530 ret = -EIO; 531 goto out_err; 532 } 533 534 data = TPM_STS_GO; 535 ret = st33zp24_spi_write(dev, TPM_STS, &data, 1); 536 if (ret < 0) 537 goto out_err; 538 539 return len; 540 541 out_err: 542 st33zp24_spi_cancel(dev); 543 st33zp24_spi_release_locality(dev); 544 545 return ret; 546 } 547 548 static int st33zp24_spi_cleanup(struct udevice *dev) 549 { 550 st33zp24_spi_cancel(dev); 551 /* 552 * The TPM needs some time to clean up here, 553 * so we sleep rather than keeping the bus busy 554 */ 555 mdelay(2); 556 st33zp24_spi_release_locality(dev); 557 558 return 0; 559 } 560 561 static int st33zp24_spi_init(struct udevice *dev) 562 { 563 struct tpm_chip *chip = dev_get_priv(dev); 564 struct st33zp24_spi_phy *phy = dev_get_platdata(dev); 565 566 chip->is_open = 1; 567 568 /* Default timeouts - these could move to the device tree */ 569 chip->timeout_a = TIS_SHORT_TIMEOUT_MS; 570 chip->timeout_b = TIS_LONG_TIMEOUT_MS; 571 chip->timeout_c = TIS_SHORT_TIMEOUT_MS; 572 chip->timeout_d = TIS_SHORT_TIMEOUT_MS; 573 574 chip->locality = LOCALITY0; 575 576 phy->latency = st33zp24_spi_evaluate_latency(dev); 577 if (phy->latency <= 0) 578 return -ENODEV; 579 580 /* 581 * A timeout query to TPM can be placed here. 582 * Standard timeout values are used so far 583 */ 584 585 return 0; 586 } 587 588 static int st33zp24_spi_open(struct udevice *dev) 589 { 590 struct tpm_chip *chip = dev_get_priv(dev); 591 int rc; 592 593 debug("%s: start\n", __func__); 594 if (chip->is_open) 595 return -EBUSY; 596 597 rc = st33zp24_spi_init(dev); 598 if (rc < 0) 599 chip->is_open = 0; 600 601 return rc; 602 } 603 604 static int st33zp24_spi_close(struct udevice *dev) 605 { 606 struct tpm_chip *chip = dev_get_priv(dev); 607 608 if (chip->is_open) { 609 st33zp24_spi_release_locality(dev); 610 chip->is_open = 0; 611 chip->vend_dev = 0; 612 } 613 614 return 0; 615 } 616 617 static int st33zp24_spi_get_desc(struct udevice *dev, char *buf, int size) 618 { 619 struct tpm_chip *chip = dev_get_priv(dev); 620 621 if (size < 50) 622 return -ENOSPC; 623 624 return snprintf(buf, size, "1.2 TPM (%s, chip type %s device-id 0x%x)", 625 chip->is_open ? "open" : "closed", 626 dev->name, 627 chip->vend_dev >> 16); 628 } 629 630 const struct tpm_ops st33zp24_spi_tpm_ops = { 631 .open = st33zp24_spi_open, 632 .close = st33zp24_spi_close, 633 .recv = st33zp24_spi_recv, 634 .send = st33zp24_spi_send, 635 .cleanup = st33zp24_spi_cleanup, 636 .get_desc = st33zp24_spi_get_desc, 637 }; 638 639 static int st33zp24_spi_probe(struct udevice *dev) 640 { 641 struct tpm_chip_priv *uc_priv = dev_get_uclass_priv(dev); 642 643 uc_priv->duration_ms[TPM_SHORT] = TIS_SHORT_TIMEOUT_MS; 644 uc_priv->duration_ms[TPM_MEDIUM] = TIS_LONG_TIMEOUT_MS; 645 uc_priv->duration_ms[TPM_LONG] = TIS_LONG_TIMEOUT_MS; 646 uc_priv->retry_time_ms = TPM_TIMEOUT_MS; 647 648 debug("ST33ZP24 SPI TPM from STMicroelectronics found\n"); 649 650 return 0; 651 } 652 653 static int st33zp24_spi_remove(struct udevice *dev) 654 { 655 st33zp24_spi_release_locality(dev); 656 657 return 0; 658 } 659 660 static const struct udevice_id st33zp24_spi_ids[] = { 661 { .compatible = "st,st33zp24-spi" }, 662 { } 663 }; 664 665 U_BOOT_DRIVER(st33zp24_spi_spi) = { 666 .name = "st33zp24-spi", 667 .id = UCLASS_TPM, 668 .of_match = of_match_ptr(st33zp24_spi_ids), 669 .probe = st33zp24_spi_probe, 670 .remove = st33zp24_spi_remove, 671 .ops = &st33zp24_spi_tpm_ops, 672 .priv_auto_alloc_size = sizeof(struct tpm_chip), 673 .platdata_auto_alloc_size = sizeof(struct st33zp24_spi_phy), 674 }; 675