tpm_tis_lpc.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2011 The Chromium OS Authors.
  4. */
  5. /*
  6. * The code in this file is based on the article "Writing a TPM Device Driver"
  7. * published on http://ptgmedia.pearsoncmg.com.
  8. *
  9. * One principal difference is that in the simplest config the other than 0
  10. * TPM localities do not get mapped by some devices (for instance, by Infineon
  11. * slb9635), so this driver provides access to locality 0 only.
  12. */
  13. #include <common.h>
  14. #include <dm.h>
  15. #include <log.h>
  16. #include <mapmem.h>
  17. #include <tpm-v1.h>
  18. #include <asm/io.h>
  19. #include <linux/delay.h>
  20. #define PREFIX "lpc_tpm: "
  21. enum i2c_chip_type {
  22. SLB9635,
  23. AT97SC3204,
  24. };
  25. static const char * const chip_name[] = {
  26. [SLB9635] = "Infineon SLB9635 TT 1.2",
  27. [AT97SC3204] = "Atmel AT97SC3204",
  28. };
  29. static const u32 chip_didvid[] = {
  30. [SLB9635] = 0xb15d1,
  31. [AT97SC3204] = 0x32041114,
  32. };
  33. struct tpm_locality {
  34. u32 access;
  35. u8 padding0[4];
  36. u32 int_enable;
  37. u8 vector;
  38. u8 padding1[3];
  39. u32 int_status;
  40. u32 int_capability;
  41. u32 tpm_status;
  42. u8 padding2[8];
  43. u8 data;
  44. u8 padding3[3803];
  45. u32 did_vid;
  46. u8 rid;
  47. u8 padding4[251];
  48. };
  49. struct tpm_tis_lpc_priv {
  50. struct tpm_locality *regs;
  51. };
  52. /*
  53. * This pointer refers to the TPM chip, 5 of its localities are mapped as an
  54. * array.
  55. */
  56. #define TPM_TOTAL_LOCALITIES 5
  57. /* Some registers' bit field definitions */
  58. #define TIS_STS_VALID (1 << 7) /* 0x80 */
  59. #define TIS_STS_COMMAND_READY (1 << 6) /* 0x40 */
  60. #define TIS_STS_TPM_GO (1 << 5) /* 0x20 */
  61. #define TIS_STS_DATA_AVAILABLE (1 << 4) /* 0x10 */
  62. #define TIS_STS_EXPECT (1 << 3) /* 0x08 */
  63. #define TIS_STS_RESPONSE_RETRY (1 << 1) /* 0x02 */
  64. #define TIS_ACCESS_TPM_REG_VALID_STS (1 << 7) /* 0x80 */
  65. #define TIS_ACCESS_ACTIVE_LOCALITY (1 << 5) /* 0x20 */
  66. #define TIS_ACCESS_BEEN_SEIZED (1 << 4) /* 0x10 */
  67. #define TIS_ACCESS_SEIZE (1 << 3) /* 0x08 */
  68. #define TIS_ACCESS_PENDING_REQUEST (1 << 2) /* 0x04 */
  69. #define TIS_ACCESS_REQUEST_USE (1 << 1) /* 0x02 */
  70. #define TIS_ACCESS_TPM_ESTABLISHMENT (1 << 0) /* 0x01 */
  71. #define TIS_STS_BURST_COUNT_MASK (0xffff)
  72. #define TIS_STS_BURST_COUNT_SHIFT (8)
  73. /* 1 second is plenty for anything TPM does. */
  74. #define MAX_DELAY_US (1000 * 1000)
  75. /* Retrieve burst count value out of the status register contents. */
  76. static u16 burst_count(u32 status)
  77. {
  78. return (status >> TIS_STS_BURST_COUNT_SHIFT) &
  79. TIS_STS_BURST_COUNT_MASK;
  80. }
  81. /* TPM access wrappers to support tracing */
  82. static u8 tpm_read_byte(struct tpm_tis_lpc_priv *priv, const u8 *ptr)
  83. {
  84. u8 ret = readb(ptr);
  85. debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n",
  86. (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
  87. return ret;
  88. }
  89. static u32 tpm_read_word(struct tpm_tis_lpc_priv *priv, const u32 *ptr)
  90. {
  91. u32 ret = readl(ptr);
  92. debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n",
  93. (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
  94. return ret;
  95. }
  96. static void tpm_write_byte(struct tpm_tis_lpc_priv *priv, u8 value, u8 *ptr)
  97. {
  98. debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n",
  99. (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
  100. writeb(value, ptr);
  101. }
  102. static void tpm_write_word(struct tpm_tis_lpc_priv *priv, u32 value,
  103. u32 *ptr)
  104. {
  105. debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n",
  106. (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
  107. writel(value, ptr);
  108. }
  109. /*
  110. * tis_wait_reg()
  111. *
  112. * Wait for at least a second for a register to change its state to match the
  113. * expected state. Normally the transition happens within microseconds.
  114. *
  115. * @reg - pointer to the TPM register
  116. * @mask - bitmask for the bitfield(s) to watch
  117. * @expected - value the field(s) are supposed to be set to
  118. *
  119. * Returns the register contents in case the expected value was found in the
  120. * appropriate register bits, or -ETIMEDOUT on timeout.
  121. */
  122. static int tis_wait_reg(struct tpm_tis_lpc_priv *priv, u32 *reg, u8 mask,
  123. u8 expected)
  124. {
  125. u32 time_us = MAX_DELAY_US;
  126. while (time_us > 0) {
  127. u32 value = tpm_read_word(priv, reg);
  128. if ((value & mask) == expected)
  129. return value;
  130. udelay(1); /* 1 us */
  131. time_us--;
  132. }
  133. return -ETIMEDOUT;
  134. }
  135. /*
  136. * Probe the TPM device and try determining its manufacturer/device name.
  137. *
  138. * Returns 0 on success, -ve on error
  139. */
  140. static int tpm_tis_lpc_probe(struct udevice *dev)
  141. {
  142. struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
  143. fdt_addr_t addr;
  144. u32 didvid;
  145. ulong chip_type = dev_get_driver_data(dev);
  146. addr = dev_read_addr(dev);
  147. if (addr == FDT_ADDR_T_NONE)
  148. return -EINVAL;
  149. priv->regs = map_sysmem(addr, 0);
  150. didvid = tpm_read_word(priv, &priv->regs[0].did_vid);
  151. if (didvid != chip_didvid[chip_type]) {
  152. u32 vid, did;
  153. vid = didvid & 0xffff;
  154. did = (didvid >> 16) & 0xffff;
  155. debug("Invalid vendor/device ID %04x/%04x\n", vid, did);
  156. return -ENODEV;
  157. }
  158. debug("Found TPM: %s\n", chip_name[chip_type]);
  159. return 0;
  160. }
  161. /*
  162. * tis_senddata()
  163. *
  164. * send the passed in data to the TPM device.
  165. *
  166. * @data - address of the data to send, byte by byte
  167. * @len - length of the data to send
  168. *
  169. * Returns 0 on success, -ve on error (in case the device does not accept
  170. * the entire command).
  171. */
  172. static int tis_senddata(struct udevice *dev, const u8 *data, size_t len)
  173. {
  174. struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
  175. struct tpm_locality *regs = priv->regs;
  176. u32 offset = 0;
  177. u16 burst = 0;
  178. u32 max_cycles = 0;
  179. u8 locality = 0;
  180. u32 value;
  181. value = tis_wait_reg(priv, &regs[locality].tpm_status,
  182. TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY);
  183. if (value == -ETIMEDOUT) {
  184. printf("%s:%d - failed to get 'command_ready' status\n",
  185. __FILE__, __LINE__);
  186. return value;
  187. }
  188. burst = burst_count(value);
  189. while (1) {
  190. unsigned count;
  191. /* Wait till the device is ready to accept more data. */
  192. while (!burst) {
  193. if (max_cycles++ == MAX_DELAY_US) {
  194. printf("%s:%d failed to feed %zd bytes of %zd\n",
  195. __FILE__, __LINE__, len - offset, len);
  196. return -ETIMEDOUT;
  197. }
  198. udelay(1);
  199. burst = burst_count(tpm_read_word(priv,
  200. &regs[locality].tpm_status));
  201. }
  202. max_cycles = 0;
  203. /*
  204. * Calculate number of bytes the TPM is ready to accept in one
  205. * shot.
  206. *
  207. * We want to send the last byte outside of the loop (hence
  208. * the -1 below) to make sure that the 'expected' status bit
  209. * changes to zero exactly after the last byte is fed into the
  210. * FIFO.
  211. */
  212. count = min((size_t)burst, len - offset - 1);
  213. while (count--)
  214. tpm_write_byte(priv, data[offset++],
  215. &regs[locality].data);
  216. value = tis_wait_reg(priv, &regs[locality].tpm_status,
  217. TIS_STS_VALID, TIS_STS_VALID);
  218. if ((value == -ETIMEDOUT) || !(value & TIS_STS_EXPECT)) {
  219. printf("%s:%d TPM command feed overflow\n",
  220. __FILE__, __LINE__);
  221. return value == -ETIMEDOUT ? value : -EIO;
  222. }
  223. burst = burst_count(value);
  224. if ((offset == (len - 1)) && burst) {
  225. /*
  226. * We need to be able to send the last byte to the
  227. * device, so burst size must be nonzero before we
  228. * break out.
  229. */
  230. break;
  231. }
  232. }
  233. /* Send the last byte. */
  234. tpm_write_byte(priv, data[offset++], &regs[locality].data);
  235. /*
  236. * Verify that TPM does not expect any more data as part of this
  237. * command.
  238. */
  239. value = tis_wait_reg(priv, &regs[locality].tpm_status,
  240. TIS_STS_VALID, TIS_STS_VALID);
  241. if ((value == -ETIMEDOUT) || (value & TIS_STS_EXPECT)) {
  242. printf("%s:%d unexpected TPM status 0x%x\n",
  243. __FILE__, __LINE__, value);
  244. return value == -ETIMEDOUT ? value : -EIO;
  245. }
  246. /* OK, sitting pretty, let's start the command execution. */
  247. tpm_write_word(priv, TIS_STS_TPM_GO, &regs[locality].tpm_status);
  248. return 0;
  249. }
  250. /*
  251. * tis_readresponse()
  252. *
  253. * read the TPM device response after a command was issued.
  254. *
  255. * @buffer - address where to read the response, byte by byte.
  256. * @len - pointer to the size of buffer
  257. *
  258. * On success stores the number of received bytes to len and returns 0. On
  259. * errors (misformatted TPM data or synchronization problems) returns
  260. * -ve value.
  261. */
  262. static int tis_readresponse(struct udevice *dev, u8 *buffer, size_t len)
  263. {
  264. struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
  265. struct tpm_locality *regs = priv->regs;
  266. u16 burst;
  267. u32 value;
  268. u32 offset = 0;
  269. u8 locality = 0;
  270. const u32 has_data = TIS_STS_DATA_AVAILABLE | TIS_STS_VALID;
  271. u32 expected_count = len;
  272. int max_cycles = 0;
  273. /* Wait for the TPM to process the command. */
  274. value = tis_wait_reg(priv, &regs[locality].tpm_status,
  275. has_data, has_data);
  276. if (value == -ETIMEDOUT) {
  277. printf("%s:%d failed processing command\n",
  278. __FILE__, __LINE__);
  279. return value;
  280. }
  281. do {
  282. while ((burst = burst_count(value)) == 0) {
  283. if (max_cycles++ == MAX_DELAY_US) {
  284. printf("%s:%d TPM stuck on read\n",
  285. __FILE__, __LINE__);
  286. return -EIO;
  287. }
  288. udelay(1);
  289. value = tpm_read_word(priv, &regs[locality].tpm_status);
  290. }
  291. max_cycles = 0;
  292. while (burst-- && (offset < expected_count)) {
  293. buffer[offset++] = tpm_read_byte(priv,
  294. &regs[locality].data);
  295. if (offset == 6) {
  296. /*
  297. * We got the first six bytes of the reply,
  298. * let's figure out how many bytes to expect
  299. * total - it is stored as a 4 byte number in
  300. * network order, starting with offset 2 into
  301. * the body of the reply.
  302. */
  303. u32 real_length;
  304. memcpy(&real_length,
  305. buffer + 2,
  306. sizeof(real_length));
  307. expected_count = be32_to_cpu(real_length);
  308. if ((expected_count < offset) ||
  309. (expected_count > len)) {
  310. printf("%s:%d bad response size %d\n",
  311. __FILE__, __LINE__,
  312. expected_count);
  313. return -ENOSPC;
  314. }
  315. }
  316. }
  317. /* Wait for the next portion. */
  318. value = tis_wait_reg(priv, &regs[locality].tpm_status,
  319. TIS_STS_VALID, TIS_STS_VALID);
  320. if (value == -ETIMEDOUT) {
  321. printf("%s:%d failed to read response\n",
  322. __FILE__, __LINE__);
  323. return value;
  324. }
  325. if (offset == expected_count)
  326. break; /* We got all we needed. */
  327. } while ((value & has_data) == has_data);
  328. /*
  329. * Make sure we indeed read all there was. The TIS_STS_VALID bit is
  330. * known to be set.
  331. */
  332. if (value & TIS_STS_DATA_AVAILABLE) {
  333. printf("%s:%d wrong receive status %x\n",
  334. __FILE__, __LINE__, value);
  335. return -EBADMSG;
  336. }
  337. /* Tell the TPM that we are done. */
  338. tpm_write_word(priv, TIS_STS_COMMAND_READY,
  339. &regs[locality].tpm_status);
  340. return offset;
  341. }
  342. static int tpm_tis_lpc_close(struct udevice *dev)
  343. {
  344. struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
  345. struct tpm_locality *regs = priv->regs;
  346. u8 locality = 0;
  347. if (tpm_read_word(priv, &regs[locality].access) &
  348. TIS_ACCESS_ACTIVE_LOCALITY) {
  349. tpm_write_word(priv, TIS_ACCESS_ACTIVE_LOCALITY,
  350. &regs[locality].access);
  351. if (tis_wait_reg(priv, &regs[locality].access,
  352. TIS_ACCESS_ACTIVE_LOCALITY, 0) == -ETIMEDOUT) {
  353. printf("%s:%d - failed to release locality %d\n",
  354. __FILE__, __LINE__, locality);
  355. return -ETIMEDOUT;
  356. }
  357. }
  358. return 0;
  359. }
  360. static int tpm_tis_lpc_open(struct udevice *dev)
  361. {
  362. struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
  363. struct tpm_locality *regs = priv->regs;
  364. u8 locality = 0; /* we use locality zero for everything. */
  365. int ret;
  366. ret = tpm_tis_lpc_close(dev);
  367. if (ret) {
  368. printf("%s: Failed to close TPM\n", __func__);
  369. return ret;
  370. }
  371. /* now request access to locality. */
  372. tpm_write_word(priv, TIS_ACCESS_REQUEST_USE, &regs[locality].access);
  373. /* did we get a lock? */
  374. ret = tis_wait_reg(priv, &regs[locality].access,
  375. TIS_ACCESS_ACTIVE_LOCALITY,
  376. TIS_ACCESS_ACTIVE_LOCALITY);
  377. if (ret == -ETIMEDOUT) {
  378. printf("%s:%d - failed to lock locality %d\n",
  379. __FILE__, __LINE__, locality);
  380. return ret;
  381. }
  382. tpm_write_word(priv, TIS_STS_COMMAND_READY,
  383. &regs[locality].tpm_status);
  384. return 0;
  385. }
  386. static int tpm_tis_get_desc(struct udevice *dev, char *buf, int size)
  387. {
  388. ulong chip_type = dev_get_driver_data(dev);
  389. if (size < 50)
  390. return -ENOSPC;
  391. return snprintf(buf, size, "1.2 TPM (%s)",
  392. chip_name[chip_type]);
  393. }
  394. static const struct tpm_ops tpm_tis_lpc_ops = {
  395. .open = tpm_tis_lpc_open,
  396. .close = tpm_tis_lpc_close,
  397. .get_desc = tpm_tis_get_desc,
  398. .send = tis_senddata,
  399. .recv = tis_readresponse,
  400. };
  401. static const struct udevice_id tpm_tis_lpc_ids[] = {
  402. { .compatible = "infineon,slb9635lpc", .data = SLB9635 },
  403. { .compatible = "atmel,at97sc3204", .data = AT97SC3204 },
  404. { }
  405. };
  406. U_BOOT_DRIVER(tpm_tis_lpc) = {
  407. .name = "tpm_tis_lpc",
  408. .id = UCLASS_TPM,
  409. .of_match = tpm_tis_lpc_ids,
  410. .ops = &tpm_tis_lpc_ops,
  411. .probe = tpm_tis_lpc_probe,
  412. .priv_auto = sizeof(struct tpm_tis_lpc_priv),
  413. };