drivers/tpm/tpm_tis_lpc.c

   1 /*
   2  * Copyright (c) 2011 The Chromium OS Authors.
   3  *
   4  * SPDX-License-Identifier:     GPL-2.0+
   5  */
   6
   7 /*
   8  * The code in this file is based on the article "Writing a TPM Device Driver"
   9  * published on http://ptgmedia.pearsoncmg.com.
  10  *
  11  * One principal difference is that in the simplest config the other than 0
  12  * TPM localities do not get mapped by some devices (for instance, by Infineon
  13  * slb9635), so this driver provides access to locality 0 only.
  14  */
  15
  16 #include <common.h>
  17 #include <dm.h>
  18 #include <mapmem.h>
  19 #include <tpm.h>
  20 #include <asm/io.h>
  21
  22 #define PREFIX "lpc_tpm: "
  23
  24 struct tpm_locality {
  25         u32 access;
  26         u8 padding0[4];
  27         u32 int_enable;
  28         u8 vector;
  29         u8 padding1[3];
  30         u32 int_status;
  31         u32 int_capability;
  32         u32 tpm_status;
  33         u8 padding2[8];
  34         u8 data;
  35         u8 padding3[3803];
  36         u32 did_vid;
  37         u8 rid;
  38         u8 padding4[251];
  39 };
  40
  41 struct tpm_tis_lpc_priv {
  42         struct tpm_locality *regs;
  43 };
  44
  45 /*
  46  * This pointer refers to the TPM chip, 5 of its localities are mapped as an
  47  * array.
  48  */
  49 #define TPM_TOTAL_LOCALITIES    5
  50
  51 /* Some registers' bit field definitions */
  52 #define TIS_STS_VALID                  (1 << 7) /* 0x80 */
  53 #define TIS_STS_COMMAND_READY          (1 << 6) /* 0x40 */
  54 #define TIS_STS_TPM_GO                 (1 << 5) /* 0x20 */
  55 #define TIS_STS_DATA_AVAILABLE         (1 << 4) /* 0x10 */
  56 #define TIS_STS_EXPECT                 (1 << 3) /* 0x08 */
  57 #define TIS_STS_RESPONSE_RETRY         (1 << 1) /* 0x02 */
  58
  59 #define TIS_ACCESS_TPM_REG_VALID_STS   (1 << 7) /* 0x80 */
  60 #define TIS_ACCESS_ACTIVE_LOCALITY     (1 << 5) /* 0x20 */
  61 #define TIS_ACCESS_BEEN_SEIZED         (1 << 4) /* 0x10 */
  62 #define TIS_ACCESS_SEIZE               (1 << 3) /* 0x08 */
  63 #define TIS_ACCESS_PENDING_REQUEST     (1 << 2) /* 0x04 */
  64 #define TIS_ACCESS_REQUEST_USE         (1 << 1) /* 0x02 */
  65 #define TIS_ACCESS_TPM_ESTABLISHMENT   (1 << 0) /* 0x01 */
  66
  67 #define TIS_STS_BURST_COUNT_MASK       (0xffff)
  68 #define TIS_STS_BURST_COUNT_SHIFT      (8)
  69
  70  /* 1 second is plenty for anything TPM does. */
  71 #define MAX_DELAY_US    (1000 * 1000)
  72
  73 /* Retrieve burst count value out of the status register contents. */
  74 static u16 burst_count(u32 status)
  75 {
  76         return (status >> TIS_STS_BURST_COUNT_SHIFT) &
  77                         TIS_STS_BURST_COUNT_MASK;
  78 }
  79
  80 /* TPM access wrappers to support tracing */
  81 static u8 tpm_read_byte(struct tpm_tis_lpc_priv *priv, const u8 *ptr)
  82 {
  83         u8  ret = readb(ptr);
  84         debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n",
  85               (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
  86         return ret;
  87 }
  88
  89 static u32 tpm_read_word(struct tpm_tis_lpc_priv *priv, const u32 *ptr)
  90 {
  91         u32  ret = readl(ptr);
  92         debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n",
  93               (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
  94         return ret;
  95 }
  96
  97 static void tpm_write_byte(struct tpm_tis_lpc_priv *priv, u8 value, u8 *ptr)
  98 {
  99         debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n",
 100               (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
 101         writeb(value, ptr);
 102 }
 103
 104 static void tpm_write_word(struct tpm_tis_lpc_priv *priv, u32 value,
 105                            u32 *ptr)
 106 {
 107         debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n",
 108               (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
 109         writel(value, ptr);
 110 }
 111
 112 /*
 113  * tis_wait_reg()
 114  *
 115  * Wait for at least a second for a register to change its state to match the
 116  * expected state. Normally the transition happens within microseconds.
 117  *
 118  * @reg - pointer to the TPM register
 119  * @mask - bitmask for the bitfield(s) to watch
 120  * @expected - value the field(s) are supposed to be set to
 121  *
 122  * Returns the register contents in case the expected value was found in the
 123  * appropriate register bits, or -ETIMEDOUT on timeout.
 124  */
 125 static int tis_wait_reg(struct tpm_tis_lpc_priv *priv, u32 *reg, u8 mask,
 126                         u8 expected)
 127 {
 128         u32 time_us = MAX_DELAY_US;
 129
 130         while (time_us > 0) {
 131                 u32 value = tpm_read_word(priv, reg);
 132                 if ((value & mask) == expected)
 133                         return value;
 134                 udelay(1); /* 1 us */
 135                 time_us--;
 136         }
 137
 138         return -ETIMEDOUT;
 139 }
 140
 141 /*
 142  * Probe the TPM device and try determining its manufacturer/device name.
 143  *
 144  * Returns 0 on success, -ve on error
 145  */
 146 static int tpm_tis_lpc_probe(struct udevice *dev)
 147 {
 148         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 149         u32 vid, did;
 150         fdt_addr_t addr;
 151         u32 didvid;
 152
 153         addr = dev_get_addr(dev);
 154         if (addr == FDT_ADDR_T_NONE)
 155                 return -EINVAL;
 156         priv->regs = map_sysmem(addr, 0);
 157         didvid = tpm_read_word(priv, &priv->regs[0].did_vid);
 158
 159         vid = didvid & 0xffff;
 160         did = (didvid >> 16) & 0xffff;
 161         if (vid != 0x15d1 || did != 0xb) {
 162                 debug("Invalid vendor/device ID %04x/%04x\n", vid, did);
 163                 return -ENOSYS;
 164         }
 165
 166         debug("Found TPM %s by %s\n", "SLB9635 TT 1.2", "Infineon");
 167
 168         return 0;
 169 }
 170
 171 /*
 172  * tis_senddata()
 173  *
 174  * send the passed in data to the TPM device.
 175  *
 176  * @data - address of the data to send, byte by byte
 177  * @len - length of the data to send
 178  *
 179  * Returns 0 on success, -ve on error (in case the device does not accept
 180  * the entire command).
 181  */
 182 static int tis_senddata(struct udevice *dev, const u8 *data, size_t len)
 183 {
 184         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 185         struct tpm_locality *regs = priv->regs;
 186         u32 offset = 0;
 187         u16 burst = 0;
 188         u32 max_cycles = 0;
 189         u8 locality = 0;
 190         u32 value;
 191
 192         value = tis_wait_reg(priv, &regs[locality].tpm_status,
 193                              TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY);
 194         if (value == -ETIMEDOUT) {
 195                 printf("%s:%d - failed to get 'command_ready' status\n",
 196                        __FILE__, __LINE__);
 197                 return value;
 198         }
 199         burst = burst_count(value);
 200
 201         while (1) {
 202                 unsigned count;
 203
 204                 /* Wait till the device is ready to accept more data. */
 205                 while (!burst) {
 206                         if (max_cycles++ == MAX_DELAY_US) {
 207                                 printf("%s:%d failed to feed %d bytes of %d\n",
 208                                        __FILE__, __LINE__, len - offset, len);
 209                                 return -ETIMEDOUT;
 210                         }
 211                         udelay(1);
 212                         burst = burst_count(tpm_read_word(priv,
 213                                         &regs[locality].tpm_status));
 214                 }
 215
 216                 max_cycles = 0;
 217
 218                 /*
 219                  * Calculate number of bytes the TPM is ready to accept in one
 220                  * shot.
 221                  *
 222                  * We want to send the last byte outside of the loop (hence
 223                  * the -1 below) to make sure that the 'expected' status bit
 224                  * changes to zero exactly after the last byte is fed into the
 225                  * FIFO.
 226                  */
 227                 count = min((u32)burst, len - offset - 1);
 228                 while (count--)
 229                         tpm_write_byte(priv, data[offset++],
 230                                        &regs[locality].data);
 231
 232                 value = tis_wait_reg(priv, &regs[locality].tpm_status,
 233                                      TIS_STS_VALID, TIS_STS_VALID);
 234
 235                 if ((value == -ETIMEDOUT) || !(value & TIS_STS_EXPECT)) {
 236                         printf("%s:%d TPM command feed overflow\n",
 237                                __FILE__, __LINE__);
 238                         return value == -ETIMEDOUT ? value : -EIO;
 239                 }
 240
 241                 burst = burst_count(value);
 242                 if ((offset == (len - 1)) && burst) {
 243                         /*
 244                          * We need to be able to send the last byte to the
 245                          * device, so burst size must be nonzero before we
 246                          * break out.
 247                          */
 248                         break;
 249                 }
 250         }
 251
 252         /* Send the last byte. */
 253         tpm_write_byte(priv, data[offset++], &regs[locality].data);
 254         /*
 255          * Verify that TPM does not expect any more data as part of this
 256          * command.
 257          */
 258         value = tis_wait_reg(priv, &regs[locality].tpm_status,
 259                              TIS_STS_VALID, TIS_STS_VALID);
 260         if ((value == -ETIMEDOUT) || (value & TIS_STS_EXPECT)) {
 261                 printf("%s:%d unexpected TPM status 0x%x\n",
 262                        __FILE__, __LINE__, value);
 263                 return value == -ETIMEDOUT ? value : -EIO;
 264         }
 265
 266         /* OK, sitting pretty, let's start the command execution. */
 267         tpm_write_word(priv, TIS_STS_TPM_GO, &regs[locality].tpm_status);
 268         return 0;
 269 }
 270
 271 /*
 272  * tis_readresponse()
 273  *
 274  * read the TPM device response after a command was issued.
 275  *
 276  * @buffer - address where to read the response, byte by byte.
 277  * @len - pointer to the size of buffer
 278  *
 279  * On success stores the number of received bytes to len and returns 0. On
 280  * errors (misformatted TPM data or synchronization problems) returns
 281  * -ve value.
 282  */
 283 static int tis_readresponse(struct udevice *dev, u8 *buffer, size_t len)
 284 {
 285         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 286         struct tpm_locality *regs = priv->regs;
 287         u16 burst;
 288         u32 value;
 289         u32 offset = 0;
 290         u8 locality = 0;
 291         const u32 has_data = TIS_STS_DATA_AVAILABLE | TIS_STS_VALID;
 292         u32 expected_count = len;
 293         int max_cycles = 0;
 294
 295         /* Wait for the TPM to process the command. */
 296         value = tis_wait_reg(priv, &regs[locality].tpm_status,
 297                               has_data, has_data);
 298         if (value == -ETIMEDOUT) {
 299                 printf("%s:%d failed processing command\n",
 300                        __FILE__, __LINE__);
 301                 return value;
 302         }
 303
 304         do {
 305                 while ((burst = burst_count(value)) == 0) {
 306                         if (max_cycles++ == MAX_DELAY_US) {
 307                                 printf("%s:%d TPM stuck on read\n",
 308                                        __FILE__, __LINE__);
 309                                 return -EIO;
 310                         }
 311                         udelay(1);
 312                         value = tpm_read_word(priv, &regs[locality].tpm_status);
 313                 }
 314
 315                 max_cycles = 0;
 316
 317                 while (burst-- && (offset < expected_count)) {
 318                         buffer[offset++] = tpm_read_byte(priv,
 319                                                 &regs[locality].data);
 320
 321                         if (offset == 6) {
 322                                 /*
 323                                  * We got the first six bytes of the reply,
 324                                  * let's figure out how many bytes to expect
 325                                  * total - it is stored as a 4 byte number in
 326                                  * network order, starting with offset 2 into
 327                                  * the body of the reply.
 328                                  */
 329                                 u32 real_length;
 330                                 memcpy(&real_length,
 331                                        buffer + 2,
 332                                        sizeof(real_length));
 333                                 expected_count = be32_to_cpu(real_length);
 334
 335                                 if ((expected_count < offset) ||
 336                                     (expected_count > len)) {
 337                                         printf("%s:%d bad response size %d\n",
 338                                                __FILE__, __LINE__,
 339                                                expected_count);
 340                                         return -ENOSPC;
 341                                 }
 342                         }
 343                 }
 344
 345                 /* Wait for the next portion. */
 346                 value = tis_wait_reg(priv, &regs[locality].tpm_status,
 347                                      TIS_STS_VALID, TIS_STS_VALID);
 348                 if (value == -ETIMEDOUT) {
 349                         printf("%s:%d failed to read response\n",
 350                                __FILE__, __LINE__);
 351                         return value;
 352                 }
 353
 354                 if (offset == expected_count)
 355                         break;  /* We got all we needed. */
 356
 357         } while ((value & has_data) == has_data);
 358
 359         /*
 360          * Make sure we indeed read all there was. The TIS_STS_VALID bit is
 361          * known to be set.
 362          */
 363         if (value & TIS_STS_DATA_AVAILABLE) {
 364                 printf("%s:%d wrong receive status %x\n",
 365                        __FILE__, __LINE__, value);
 366                 return -EBADMSG;
 367         }
 368
 369         /* Tell the TPM that we are done. */
 370         tpm_write_word(priv, TIS_STS_COMMAND_READY,
 371                        &regs[locality].tpm_status);
 372
 373         return offset;
 374 }
 375
 376 static int tpm_tis_lpc_open(struct udevice *dev)
 377 {
 378         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 379         struct tpm_locality *regs = priv->regs;
 380         u8 locality = 0; /* we use locality zero for everything. */
 381         int ret;
 382
 383         /* now request access to locality. */
 384         tpm_write_word(priv, TIS_ACCESS_REQUEST_USE, &regs[locality].access);
 385
 386         /* did we get a lock? */
 387         ret = tis_wait_reg(priv, &regs[locality].access,
 388                          TIS_ACCESS_ACTIVE_LOCALITY,
 389                          TIS_ACCESS_ACTIVE_LOCALITY);
 390         if (ret == -ETIMEDOUT) {
 391                 printf("%s:%d - failed to lock locality %d\n",
 392                        __FILE__, __LINE__, locality);
 393                 return ret;
 394         }
 395
 396         tpm_write_word(priv, TIS_STS_COMMAND_READY,
 397                        &regs[locality].tpm_status);
 398         return 0;
 399 }
 400
 401 static int tpm_tis_lpc_close(struct udevice *dev)
 402 {
 403         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 404         struct tpm_locality *regs = priv->regs;
 405         u8 locality = 0;
 406
 407         if (tpm_read_word(priv, &regs[locality].access) &
 408             TIS_ACCESS_ACTIVE_LOCALITY) {
 409                 tpm_write_word(priv, TIS_ACCESS_ACTIVE_LOCALITY,
 410                                &regs[locality].access);
 411
 412                 if (tis_wait_reg(priv, &regs[locality].access,
 413                                  TIS_ACCESS_ACTIVE_LOCALITY, 0) == -ETIMEDOUT) {
 414                         printf("%s:%d - failed to release locality %d\n",
 415                                __FILE__, __LINE__, locality);
 416                         return -ETIMEDOUT;
 417                 }
 418         }
 419         return 0;
 420 }
 421
 422 static int tpm_tis_get_desc(struct udevice *dev, char *buf, int size)
 423 {
 424         if (size < 50)
 425                 return -ENOSPC;
 426
 427         return snprintf(buf, size, "1.2 TPM (vendor %s, chip %s)",
 428                         "Infineon", "SLB9635 TT 1.2");
 429 }
 430
 431
 432 static const struct tpm_ops tpm_tis_lpc_ops = {
 433         .open           = tpm_tis_lpc_open,
 434         .close          = tpm_tis_lpc_close,
 435         .get_desc       = tpm_tis_get_desc,
 436         .send           = tis_senddata,
 437         .recv           = tis_readresponse,
 438 };
 439
 440 static const struct udevice_id tpm_tis_lpc_ids[] = {
 441         { .compatible = "infineon,slb9635lpc" },
 442         { }
 443 };
 444
 445 U_BOOT_DRIVER(tpm_tis_lpc) = {
 446         .name   = "tpm_tis_lpc",
 447         .id     = UCLASS_TPM,
 448         .of_match = tpm_tis_lpc_ids,
 449         .ops    = &tpm_tis_lpc_ops,
 450         .probe  = tpm_tis_lpc_probe,
 451         .priv_auto_alloc_size = sizeof(struct tpm_tis_lpc_priv),
 452 };