drivers/tpm/tpm_tis_lpc.c

   1 /*
   2  * Copyright (c) 2011 The Chromium OS Authors.
   3  *
   4  * SPDX-License-Identifier:     GPL-2.0+
   5  */
   6
   7 /*
   8  * The code in this file is based on the article "Writing a TPM Device Driver"
   9  * published on http://ptgmedia.pearsoncmg.com.
  10  *
  11  * One principal difference is that in the simplest config the other than 0
  12  * TPM localities do not get mapped by some devices (for instance, by Infineon
  13  * slb9635), so this driver provides access to locality 0 only.
  14  */
  15
  16 #include <common.h>
  17 #include <dm.h>
  18 #include <mapmem.h>
  19 #include <tpm.h>
  20 #include <asm/io.h>
  21
  22 #define PREFIX "lpc_tpm: "
  23
  24 enum i2c_chip_type {
  25         SLB9635,
  26         AT97SC3204,
  27 };
  28
  29 static const char * const chip_name[] = {
  30         [SLB9635] = "Infineon SLB9635 TT 1.2",
  31         [AT97SC3204] = "Atmel AT97SC3204",
  32 };
  33
  34 static const u32 chip_didvid[] = {
  35         [SLB9635] = 0xb15d1,
  36         [AT97SC3204] = 0x32041114,
  37 };
  38
  39 struct tpm_locality {
  40         u32 access;
  41         u8 padding0[4];
  42         u32 int_enable;
  43         u8 vector;
  44         u8 padding1[3];
  45         u32 int_status;
  46         u32 int_capability;
  47         u32 tpm_status;
  48         u8 padding2[8];
  49         u8 data;
  50         u8 padding3[3803];
  51         u32 did_vid;
  52         u8 rid;
  53         u8 padding4[251];
  54 };
  55
  56 struct tpm_tis_lpc_priv {
  57         struct tpm_locality *regs;
  58 };
  59
  60 /*
  61  * This pointer refers to the TPM chip, 5 of its localities are mapped as an
  62  * array.
  63  */
  64 #define TPM_TOTAL_LOCALITIES    5
  65
  66 /* Some registers' bit field definitions */
  67 #define TIS_STS_VALID                  (1 << 7) /* 0x80 */
  68 #define TIS_STS_COMMAND_READY          (1 << 6) /* 0x40 */
  69 #define TIS_STS_TPM_GO                 (1 << 5) /* 0x20 */
  70 #define TIS_STS_DATA_AVAILABLE         (1 << 4) /* 0x10 */
  71 #define TIS_STS_EXPECT                 (1 << 3) /* 0x08 */
  72 #define TIS_STS_RESPONSE_RETRY         (1 << 1) /* 0x02 */
  73
  74 #define TIS_ACCESS_TPM_REG_VALID_STS   (1 << 7) /* 0x80 */
  75 #define TIS_ACCESS_ACTIVE_LOCALITY     (1 << 5) /* 0x20 */
  76 #define TIS_ACCESS_BEEN_SEIZED         (1 << 4) /* 0x10 */
  77 #define TIS_ACCESS_SEIZE               (1 << 3) /* 0x08 */
  78 #define TIS_ACCESS_PENDING_REQUEST     (1 << 2) /* 0x04 */
  79 #define TIS_ACCESS_REQUEST_USE         (1 << 1) /* 0x02 */
  80 #define TIS_ACCESS_TPM_ESTABLISHMENT   (1 << 0) /* 0x01 */
  81
  82 #define TIS_STS_BURST_COUNT_MASK       (0xffff)
  83 #define TIS_STS_BURST_COUNT_SHIFT      (8)
  84
  85  /* 1 second is plenty for anything TPM does. */
  86 #define MAX_DELAY_US    (1000 * 1000)
  87
  88 /* Retrieve burst count value out of the status register contents. */
  89 static u16 burst_count(u32 status)
  90 {
  91         return (status >> TIS_STS_BURST_COUNT_SHIFT) &
  92                         TIS_STS_BURST_COUNT_MASK;
  93 }
  94
  95 /* TPM access wrappers to support tracing */
  96 static u8 tpm_read_byte(struct tpm_tis_lpc_priv *priv, const u8 *ptr)
  97 {
  98         u8  ret = readb(ptr);
  99         debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n",
 100               (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
 101         return ret;
 102 }
 103
 104 static u32 tpm_read_word(struct tpm_tis_lpc_priv *priv, const u32 *ptr)
 105 {
 106         u32  ret = readl(ptr);
 107         debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n",
 108               (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
 109         return ret;
 110 }
 111
 112 static void tpm_write_byte(struct tpm_tis_lpc_priv *priv, u8 value, u8 *ptr)
 113 {
 114         debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n",
 115               (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
 116         writeb(value, ptr);
 117 }
 118
 119 static void tpm_write_word(struct tpm_tis_lpc_priv *priv, u32 value,
 120                            u32 *ptr)
 121 {
 122         debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n",
 123               (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
 124         writel(value, ptr);
 125 }
 126
 127 /*
 128  * tis_wait_reg()
 129  *
 130  * Wait for at least a second for a register to change its state to match the
 131  * expected state. Normally the transition happens within microseconds.
 132  *
 133  * @reg - pointer to the TPM register
 134  * @mask - bitmask for the bitfield(s) to watch
 135  * @expected - value the field(s) are supposed to be set to
 136  *
 137  * Returns the register contents in case the expected value was found in the
 138  * appropriate register bits, or -ETIMEDOUT on timeout.
 139  */
 140 static int tis_wait_reg(struct tpm_tis_lpc_priv *priv, u32 *reg, u8 mask,
 141                         u8 expected)
 142 {
 143         u32 time_us = MAX_DELAY_US;
 144
 145         while (time_us > 0) {
 146                 u32 value = tpm_read_word(priv, reg);
 147                 if ((value & mask) == expected)
 148                         return value;
 149                 udelay(1); /* 1 us */
 150                 time_us--;
 151         }
 152
 153         return -ETIMEDOUT;
 154 }
 155
 156 /*
 157  * Probe the TPM device and try determining its manufacturer/device name.
 158  *
 159  * Returns 0 on success, -ve on error
 160  */
 161 static int tpm_tis_lpc_probe(struct udevice *dev)
 162 {
 163         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 164         fdt_addr_t addr;
 165         u32 didvid;
 166         ulong chip_type = dev_get_driver_data(dev);
 167
 168         addr = devfdt_get_addr(dev);
 169         if (addr == FDT_ADDR_T_NONE)
 170                 return -EINVAL;
 171         priv->regs = map_sysmem(addr, 0);
 172         didvid = tpm_read_word(priv, &priv->regs[0].did_vid);
 173
 174         if (didvid != chip_didvid[chip_type]) {
 175                 u32 vid, did;
 176                 vid = didvid & 0xffff;
 177                 did = (didvid >> 16) & 0xffff;
 178                 debug("Invalid vendor/device ID %04x/%04x\n", vid, did);
 179                 return -ENODEV;
 180         }
 181
 182         debug("Found TPM: %s\n", chip_name[chip_type]);
 183
 184         return 0;
 185 }
 186
 187 /*
 188  * tis_senddata()
 189  *
 190  * send the passed in data to the TPM device.
 191  *
 192  * @data - address of the data to send, byte by byte
 193  * @len - length of the data to send
 194  *
 195  * Returns 0 on success, -ve on error (in case the device does not accept
 196  * the entire command).
 197  */
 198 static int tis_senddata(struct udevice *dev, const u8 *data, size_t len)
 199 {
 200         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 201         struct tpm_locality *regs = priv->regs;
 202         u32 offset = 0;
 203         u16 burst = 0;
 204         u32 max_cycles = 0;
 205         u8 locality = 0;
 206         u32 value;
 207
 208         value = tis_wait_reg(priv, &regs[locality].tpm_status,
 209                              TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY);
 210         if (value == -ETIMEDOUT) {
 211                 printf("%s:%d - failed to get 'command_ready' status\n",
 212                        __FILE__, __LINE__);
 213                 return value;
 214         }
 215         burst = burst_count(value);
 216
 217         while (1) {
 218                 unsigned count;
 219
 220                 /* Wait till the device is ready to accept more data. */
 221                 while (!burst) {
 222                         if (max_cycles++ == MAX_DELAY_US) {
 223                                 printf("%s:%d failed to feed %zd bytes of %zd\n",
 224                                        __FILE__, __LINE__, len - offset, len);
 225                                 return -ETIMEDOUT;
 226                         }
 227                         udelay(1);
 228                         burst = burst_count(tpm_read_word(priv,
 229                                         &regs[locality].tpm_status));
 230                 }
 231
 232                 max_cycles = 0;
 233
 234                 /*
 235                  * Calculate number of bytes the TPM is ready to accept in one
 236                  * shot.
 237                  *
 238                  * We want to send the last byte outside of the loop (hence
 239                  * the -1 below) to make sure that the 'expected' status bit
 240                  * changes to zero exactly after the last byte is fed into the
 241                  * FIFO.
 242                  */
 243                 count = min((size_t)burst, len - offset - 1);
 244                 while (count--)
 245                         tpm_write_byte(priv, data[offset++],
 246                                        &regs[locality].data);
 247
 248                 value = tis_wait_reg(priv, &regs[locality].tpm_status,
 249                                      TIS_STS_VALID, TIS_STS_VALID);
 250
 251                 if ((value == -ETIMEDOUT) || !(value & TIS_STS_EXPECT)) {
 252                         printf("%s:%d TPM command feed overflow\n",
 253                                __FILE__, __LINE__);
 254                         return value == -ETIMEDOUT ? value : -EIO;
 255                 }
 256
 257                 burst = burst_count(value);
 258                 if ((offset == (len - 1)) && burst) {
 259                         /*
 260                          * We need to be able to send the last byte to the
 261                          * device, so burst size must be nonzero before we
 262                          * break out.
 263                          */
 264                         break;
 265                 }
 266         }
 267
 268         /* Send the last byte. */
 269         tpm_write_byte(priv, data[offset++], &regs[locality].data);
 270         /*
 271          * Verify that TPM does not expect any more data as part of this
 272          * command.
 273          */
 274         value = tis_wait_reg(priv, &regs[locality].tpm_status,
 275                              TIS_STS_VALID, TIS_STS_VALID);
 276         if ((value == -ETIMEDOUT) || (value & TIS_STS_EXPECT)) {
 277                 printf("%s:%d unexpected TPM status 0x%x\n",
 278                        __FILE__, __LINE__, value);
 279                 return value == -ETIMEDOUT ? value : -EIO;
 280         }
 281
 282         /* OK, sitting pretty, let's start the command execution. */
 283         tpm_write_word(priv, TIS_STS_TPM_GO, &regs[locality].tpm_status);
 284         return 0;
 285 }
 286
 287 /*
 288  * tis_readresponse()
 289  *
 290  * read the TPM device response after a command was issued.
 291  *
 292  * @buffer - address where to read the response, byte by byte.
 293  * @len - pointer to the size of buffer
 294  *
 295  * On success stores the number of received bytes to len and returns 0. On
 296  * errors (misformatted TPM data or synchronization problems) returns
 297  * -ve value.
 298  */
 299 static int tis_readresponse(struct udevice *dev, u8 *buffer, size_t len)
 300 {
 301         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 302         struct tpm_locality *regs = priv->regs;
 303         u16 burst;
 304         u32 value;
 305         u32 offset = 0;
 306         u8 locality = 0;
 307         const u32 has_data = TIS_STS_DATA_AVAILABLE | TIS_STS_VALID;
 308         u32 expected_count = len;
 309         int max_cycles = 0;
 310
 311         /* Wait for the TPM to process the command. */
 312         value = tis_wait_reg(priv, &regs[locality].tpm_status,
 313                               has_data, has_data);
 314         if (value == -ETIMEDOUT) {
 315                 printf("%s:%d failed processing command\n",
 316                        __FILE__, __LINE__);
 317                 return value;
 318         }
 319
 320         do {
 321                 while ((burst = burst_count(value)) == 0) {
 322                         if (max_cycles++ == MAX_DELAY_US) {
 323                                 printf("%s:%d TPM stuck on read\n",
 324                                        __FILE__, __LINE__);
 325                                 return -EIO;
 326                         }
 327                         udelay(1);
 328                         value = tpm_read_word(priv, &regs[locality].tpm_status);
 329                 }
 330
 331                 max_cycles = 0;
 332
 333                 while (burst-- && (offset < expected_count)) {
 334                         buffer[offset++] = tpm_read_byte(priv,
 335                                                 &regs[locality].data);
 336
 337                         if (offset == 6) {
 338                                 /*
 339                                  * We got the first six bytes of the reply,
 340                                  * let's figure out how many bytes to expect
 341                                  * total - it is stored as a 4 byte number in
 342                                  * network order, starting with offset 2 into
 343                                  * the body of the reply.
 344                                  */
 345                                 u32 real_length;
 346                                 memcpy(&real_length,
 347                                        buffer + 2,
 348                                        sizeof(real_length));
 349                                 expected_count = be32_to_cpu(real_length);
 350
 351                                 if ((expected_count < offset) ||
 352                                     (expected_count > len)) {
 353                                         printf("%s:%d bad response size %d\n",
 354                                                __FILE__, __LINE__,
 355                                                expected_count);
 356                                         return -ENOSPC;
 357                                 }
 358                         }
 359                 }
 360
 361                 /* Wait for the next portion. */
 362                 value = tis_wait_reg(priv, &regs[locality].tpm_status,
 363                                      TIS_STS_VALID, TIS_STS_VALID);
 364                 if (value == -ETIMEDOUT) {
 365                         printf("%s:%d failed to read response\n",
 366                                __FILE__, __LINE__);
 367                         return value;
 368                 }
 369
 370                 if (offset == expected_count)
 371                         break;  /* We got all we needed. */
 372
 373         } while ((value & has_data) == has_data);
 374
 375         /*
 376          * Make sure we indeed read all there was. The TIS_STS_VALID bit is
 377          * known to be set.
 378          */
 379         if (value & TIS_STS_DATA_AVAILABLE) {
 380                 printf("%s:%d wrong receive status %x\n",
 381                        __FILE__, __LINE__, value);
 382                 return -EBADMSG;
 383         }
 384
 385         /* Tell the TPM that we are done. */
 386         tpm_write_word(priv, TIS_STS_COMMAND_READY,
 387                        &regs[locality].tpm_status);
 388
 389         return offset;
 390 }
 391
 392 static int tpm_tis_lpc_open(struct udevice *dev)
 393 {
 394         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 395         struct tpm_locality *regs = priv->regs;
 396         u8 locality = 0; /* we use locality zero for everything. */
 397         int ret;
 398
 399         /* now request access to locality. */
 400         tpm_write_word(priv, TIS_ACCESS_REQUEST_USE, &regs[locality].access);
 401
 402         /* did we get a lock? */
 403         ret = tis_wait_reg(priv, &regs[locality].access,
 404                          TIS_ACCESS_ACTIVE_LOCALITY,
 405                          TIS_ACCESS_ACTIVE_LOCALITY);
 406         if (ret == -ETIMEDOUT) {
 407                 printf("%s:%d - failed to lock locality %d\n",
 408                        __FILE__, __LINE__, locality);
 409                 return ret;
 410         }
 411
 412         tpm_write_word(priv, TIS_STS_COMMAND_READY,
 413                        &regs[locality].tpm_status);
 414         return 0;
 415 }
 416
 417 static int tpm_tis_lpc_close(struct udevice *dev)
 418 {
 419         struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
 420         struct tpm_locality *regs = priv->regs;
 421         u8 locality = 0;
 422
 423         if (tpm_read_word(priv, &regs[locality].access) &
 424             TIS_ACCESS_ACTIVE_LOCALITY) {
 425                 tpm_write_word(priv, TIS_ACCESS_ACTIVE_LOCALITY,
 426                                &regs[locality].access);
 427
 428                 if (tis_wait_reg(priv, &regs[locality].access,
 429                                  TIS_ACCESS_ACTIVE_LOCALITY, 0) == -ETIMEDOUT) {
 430                         printf("%s:%d - failed to release locality %d\n",
 431                                __FILE__, __LINE__, locality);
 432                         return -ETIMEDOUT;
 433                 }
 434         }
 435         return 0;
 436 }
 437
 438 static int tpm_tis_get_desc(struct udevice *dev, char *buf, int size)
 439 {
 440         ulong chip_type = dev_get_driver_data(dev);
 441
 442         if (size < 50)
 443                 return -ENOSPC;
 444
 445         return snprintf(buf, size, "1.2 TPM (%s)",
 446                         chip_name[chip_type]);
 447 }
 448
 449
 450 static const struct tpm_ops tpm_tis_lpc_ops = {
 451         .open           = tpm_tis_lpc_open,
 452         .close          = tpm_tis_lpc_close,
 453         .get_desc       = tpm_tis_get_desc,
 454         .send           = tis_senddata,
 455         .recv           = tis_readresponse,
 456 };
 457
 458 static const struct udevice_id tpm_tis_lpc_ids[] = {
 459         { .compatible = "infineon,slb9635lpc", .data = SLB9635 },
 460         { .compatible = "atmel,at97sc3204", .data = AT97SC3204 },
 461         { }
 462 };
 463
 464 U_BOOT_DRIVER(tpm_tis_lpc) = {
 465         .name   = "tpm_tis_lpc",
 466         .id     = UCLASS_TPM,
 467         .of_match = tpm_tis_lpc_ids,
 468         .ops    = &tpm_tis_lpc_ops,
 469         .probe  = tpm_tis_lpc_probe,
 470         .priv_auto_alloc_size = sizeof(struct tpm_tis_lpc_priv),
 471 };