2 * Copyright (C) 2014 Intel Corporation
5 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
7 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9 * This device driver implements the TPM interface as defined in
10 * the TCG CRB 2.0 TPM specification.
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; version 2
18 #include <linux/acpi.h>
19 #include <linux/highmem.h>
20 #include <linux/rculist.h>
21 #include <linux/module.h>
22 #include <linux/pm_runtime.h>
24 #include <linux/arm-smccc.h>
28 #define ACPI_SIG_TPM2 "TPM2"
30 static const guid_t crb_acpi_start_guid
=
31 GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714,
32 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4);
35 CRB_ACPI_START_REVISION_ID
= 1,
36 CRB_ACPI_START_INDEX
= 1,
40 CRB_LOC_CTRL_REQUEST_ACCESS
= BIT(0),
41 CRB_LOC_CTRL_RELINQUISH
= BIT(1),
45 CRB_LOC_STATE_LOC_ASSIGNED
= BIT(1),
46 CRB_LOC_STATE_TPM_REG_VALID_STS
= BIT(7),
50 CRB_CTRL_REQ_CMD_READY
= BIT(0),
51 CRB_CTRL_REQ_GO_IDLE
= BIT(1),
55 CRB_CTRL_STS_ERROR
= BIT(0),
56 CRB_CTRL_STS_TPM_IDLE
= BIT(1),
60 CRB_START_INVOKE
= BIT(0),
64 CRB_CANCEL_INVOKE
= BIT(0),
67 struct crb_regs_head
{
77 struct crb_regs_tail
{
92 CRB_DRV_STS_COMPLETE
= BIT(0),
99 struct crb_regs_head __iomem
*regs_h
;
100 struct crb_regs_tail __iomem
*regs_t
;
107 struct tpm2_crb_smc
{
116 * crb_go_idle - request tpm crb device to go the idle state
119 * @priv: crb private data
121 * Write CRB_CTRL_REQ_GO_IDLE to TPM_CRB_CTRL_REQ
122 * The device should respond within TIMEOUT_C by clearing the bit.
123 * Anyhow, we do not wait here as a consequent CMD_READY request
124 * will be handled correctly even if idle was not completed.
126 * The function does nothing for devices with ACPI-start method
127 * or SMC-start method.
131 static int __maybe_unused
crb_go_idle(struct device
*dev
, struct crb_priv
*priv
)
133 if ((priv
->sm
== ACPI_TPM2_START_METHOD
) ||
134 (priv
->sm
== ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD
) ||
135 (priv
->sm
== ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC
))
138 iowrite32(CRB_CTRL_REQ_GO_IDLE
, &priv
->regs_t
->ctrl_req
);
139 /* we don't really care when this settles */
144 static bool crb_wait_for_reg_32(u32 __iomem
*reg
, u32 mask
, u32 value
,
145 unsigned long timeout
)
151 stop
= ktime_add(start
, ms_to_ktime(timeout
));
154 if ((ioread32(reg
) & mask
) == value
)
157 usleep_range(50, 100);
158 } while (ktime_before(ktime_get(), stop
));
164 * crb_cmd_ready - request tpm crb device to enter ready state
167 * @priv: crb private data
169 * Write CRB_CTRL_REQ_CMD_READY to TPM_CRB_CTRL_REQ
170 * and poll till the device acknowledge it by clearing the bit.
171 * The device should respond within TIMEOUT_C.
173 * The function does nothing for devices with ACPI-start method
174 * or SMC-start method.
176 * Return: 0 on success -ETIME on timeout;
178 static int __maybe_unused
crb_cmd_ready(struct device
*dev
,
179 struct crb_priv
*priv
)
181 if ((priv
->sm
== ACPI_TPM2_START_METHOD
) ||
182 (priv
->sm
== ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD
) ||
183 (priv
->sm
== ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC
))
186 iowrite32(CRB_CTRL_REQ_CMD_READY
, &priv
->regs_t
->ctrl_req
);
187 if (!crb_wait_for_reg_32(&priv
->regs_t
->ctrl_req
,
188 CRB_CTRL_REQ_CMD_READY
/* mask */,
191 dev_warn(dev
, "cmdReady timed out\n");
198 static int crb_request_locality(struct tpm_chip
*chip
, int loc
)
200 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
201 u32 value
= CRB_LOC_STATE_LOC_ASSIGNED
|
202 CRB_LOC_STATE_TPM_REG_VALID_STS
;
207 iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS
, &priv
->regs_h
->loc_ctrl
);
208 if (!crb_wait_for_reg_32(&priv
->regs_h
->loc_state
, value
, value
,
210 dev_warn(&chip
->dev
, "TPM_LOC_STATE_x.requestAccess timed out\n");
217 static void crb_relinquish_locality(struct tpm_chip
*chip
, int loc
)
219 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
224 iowrite32(CRB_LOC_CTRL_RELINQUISH
, &priv
->regs_h
->loc_ctrl
);
227 static u8
crb_status(struct tpm_chip
*chip
)
229 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
232 if ((ioread32(&priv
->regs_t
->ctrl_start
) & CRB_START_INVOKE
) !=
234 sts
|= CRB_DRV_STS_COMPLETE
;
239 static int crb_recv(struct tpm_chip
*chip
, u8
*buf
, size_t count
)
241 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
242 unsigned int expected
;
248 if (ioread32(&priv
->regs_t
->ctrl_sts
) & CRB_CTRL_STS_ERROR
)
251 memcpy_fromio(buf
, priv
->rsp
, 6);
252 expected
= be32_to_cpup((__be32
*) &buf
[2]);
253 if (expected
> count
|| expected
< 6)
256 memcpy_fromio(&buf
[6], &priv
->rsp
[6], expected
- 6);
261 static int crb_do_acpi_start(struct tpm_chip
*chip
)
263 union acpi_object
*obj
;
266 obj
= acpi_evaluate_dsm(chip
->acpi_dev_handle
,
267 &crb_acpi_start_guid
,
268 CRB_ACPI_START_REVISION_ID
,
269 CRB_ACPI_START_INDEX
,
273 rc
= obj
->integer
.value
== 0 ? 0 : -ENXIO
;
280 * This is a TPM Command Response Buffer start method that invokes a
281 * Secure Monitor Call to requrest the firmware to execute or cancel
284 static int tpm_crb_smc_start(struct device
*dev
, unsigned long func_id
)
286 struct arm_smccc_res res
;
288 arm_smccc_smc(func_id
, 0, 0, 0, 0, 0, 0, 0, &res
);
291 FW_BUG
"tpm_crb_smc_start() returns res.a0 = 0x%lx\n",
299 static int tpm_crb_smc_start(struct device
*dev
, unsigned long func_id
)
301 dev_err(dev
, FW_BUG
"tpm_crb: incorrect start method\n");
306 static int crb_send(struct tpm_chip
*chip
, u8
*buf
, size_t len
)
308 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
311 /* Zero the cancel register so that the next command will not get
314 iowrite32(0, &priv
->regs_t
->ctrl_cancel
);
316 if (len
> priv
->cmd_size
) {
317 dev_err(&chip
->dev
, "invalid command count value %zd %d\n",
318 len
, priv
->cmd_size
);
322 memcpy_toio(priv
->cmd
, buf
, len
);
324 /* Make sure that cmd is populated before issuing start. */
327 /* The reason for the extra quirk is that the PTT in 4th Gen Core CPUs
328 * report only ACPI start but in practice seems to require both
329 * CRB start, hence invoking CRB start method if hid == MSFT0101.
331 if ((priv
->sm
== ACPI_TPM2_COMMAND_BUFFER
) ||
332 (priv
->sm
== ACPI_TPM2_MEMORY_MAPPED
) ||
333 (!strcmp(priv
->hid
, "MSFT0101")))
334 iowrite32(CRB_START_INVOKE
, &priv
->regs_t
->ctrl_start
);
336 if ((priv
->sm
== ACPI_TPM2_START_METHOD
) ||
337 (priv
->sm
== ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD
))
338 rc
= crb_do_acpi_start(chip
);
340 if (priv
->sm
== ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC
) {
341 iowrite32(CRB_START_INVOKE
, &priv
->regs_t
->ctrl_start
);
342 rc
= tpm_crb_smc_start(&chip
->dev
, priv
->smc_func_id
);
348 static void crb_cancel(struct tpm_chip
*chip
)
350 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
352 iowrite32(CRB_CANCEL_INVOKE
, &priv
->regs_t
->ctrl_cancel
);
354 if (((priv
->sm
== ACPI_TPM2_START_METHOD
) ||
355 (priv
->sm
== ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD
)) &&
356 crb_do_acpi_start(chip
))
357 dev_err(&chip
->dev
, "ACPI Start failed\n");
360 static bool crb_req_canceled(struct tpm_chip
*chip
, u8 status
)
362 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
363 u32 cancel
= ioread32(&priv
->regs_t
->ctrl_cancel
);
365 return (cancel
& CRB_CANCEL_INVOKE
) == CRB_CANCEL_INVOKE
;
368 static const struct tpm_class_ops tpm_crb
= {
369 .flags
= TPM_OPS_AUTO_STARTUP
,
370 .status
= crb_status
,
373 .cancel
= crb_cancel
,
374 .req_canceled
= crb_req_canceled
,
375 .request_locality
= crb_request_locality
,
376 .relinquish_locality
= crb_relinquish_locality
,
377 .req_complete_mask
= CRB_DRV_STS_COMPLETE
,
378 .req_complete_val
= CRB_DRV_STS_COMPLETE
,
381 static int crb_check_resource(struct acpi_resource
*ares
, void *data
)
383 struct resource
*io_res
= data
;
384 struct resource_win win
;
385 struct resource
*res
= &(win
.res
);
387 if (acpi_dev_resource_memory(ares
, res
) ||
388 acpi_dev_resource_address_space(ares
, &win
)) {
396 static void __iomem
*crb_map_res(struct device
*dev
, struct crb_priv
*priv
,
397 struct resource
*io_res
, u64 start
, u32 size
)
399 struct resource new_res
= {
401 .end
= start
+ size
- 1,
402 .flags
= IORESOURCE_MEM
,
405 /* Detect a 64 bit address on a 32 bit system */
406 if (start
!= new_res
.start
)
407 return (void __iomem
*) ERR_PTR(-EINVAL
);
409 if (!resource_contains(io_res
, &new_res
))
410 return devm_ioremap_resource(dev
, &new_res
);
412 return priv
->iobase
+ (new_res
.start
- io_res
->start
);
416 * Work around broken BIOSs that return inconsistent values from the ACPI
417 * region vs the registers. Trust the ACPI region. Such broken systems
418 * probably cannot send large TPM commands since the buffer will be truncated.
420 static u64
crb_fixup_cmd_size(struct device
*dev
, struct resource
*io_res
,
423 if (io_res
->start
> start
|| io_res
->end
< start
)
426 if (start
+ size
- 1 <= io_res
->end
)
430 FW_BUG
"ACPI region does not cover the entire command/response buffer. %pr vs %llx %llx\n",
431 io_res
, start
, size
);
433 return io_res
->end
- start
+ 1;
436 static int crb_map_io(struct acpi_device
*device
, struct crb_priv
*priv
,
437 struct acpi_table_tpm2
*buf
)
439 struct list_head resources
;
440 struct resource io_res
;
441 struct device
*dev
= &device
->dev
;
449 INIT_LIST_HEAD(&resources
);
450 ret
= acpi_dev_get_resources(device
, &resources
, crb_check_resource
,
454 acpi_dev_free_resource_list(&resources
);
456 if (resource_type(&io_res
) != IORESOURCE_MEM
) {
457 dev_err(dev
, FW_BUG
"TPM2 ACPI table does not define a memory resource\n");
461 priv
->iobase
= devm_ioremap_resource(dev
, &io_res
);
462 if (IS_ERR(priv
->iobase
))
463 return PTR_ERR(priv
->iobase
);
465 /* The ACPI IO region starts at the head area and continues to include
466 * the control area, as one nice sane region except for some older
467 * stuff that puts the control area outside the ACPI IO region.
469 if ((priv
->sm
== ACPI_TPM2_COMMAND_BUFFER
) ||
470 (priv
->sm
== ACPI_TPM2_MEMORY_MAPPED
)) {
471 if (buf
->control_address
== io_res
.start
+
472 sizeof(*priv
->regs_h
))
473 priv
->regs_h
= priv
->iobase
;
475 dev_warn(dev
, FW_BUG
"Bad ACPI memory layout");
478 priv
->regs_t
= crb_map_res(dev
, priv
, &io_res
, buf
->control_address
,
479 sizeof(struct crb_regs_tail
));
480 if (IS_ERR(priv
->regs_t
))
481 return PTR_ERR(priv
->regs_t
);
484 * PTT HW bug w/a: wake up the device to access
485 * possibly not retained registers.
487 ret
= crb_cmd_ready(dev
, priv
);
491 pa_high
= ioread32(&priv
->regs_t
->ctrl_cmd_pa_high
);
492 pa_low
= ioread32(&priv
->regs_t
->ctrl_cmd_pa_low
);
493 cmd_pa
= ((u64
)pa_high
<< 32) | pa_low
;
494 cmd_size
= crb_fixup_cmd_size(dev
, &io_res
, cmd_pa
,
495 ioread32(&priv
->regs_t
->ctrl_cmd_size
));
497 dev_dbg(dev
, "cmd_hi = %X cmd_low = %X cmd_size %X\n",
498 pa_high
, pa_low
, cmd_size
);
500 priv
->cmd
= crb_map_res(dev
, priv
, &io_res
, cmd_pa
, cmd_size
);
501 if (IS_ERR(priv
->cmd
)) {
502 ret
= PTR_ERR(priv
->cmd
);
506 memcpy_fromio(&rsp_pa
, &priv
->regs_t
->ctrl_rsp_pa
, 8);
507 rsp_pa
= le64_to_cpu(rsp_pa
);
508 rsp_size
= crb_fixup_cmd_size(dev
, &io_res
, rsp_pa
,
509 ioread32(&priv
->regs_t
->ctrl_rsp_size
));
511 if (cmd_pa
!= rsp_pa
) {
512 priv
->rsp
= crb_map_res(dev
, priv
, &io_res
, rsp_pa
, rsp_size
);
513 ret
= PTR_ERR_OR_ZERO(priv
->rsp
);
517 /* According to the PTP specification, overlapping command and response
518 * buffer sizes must be identical.
520 if (cmd_size
!= rsp_size
) {
521 dev_err(dev
, FW_BUG
"overlapping command and response buffer sizes are not identical");
526 priv
->rsp
= priv
->cmd
;
530 priv
->cmd_size
= cmd_size
;
532 crb_go_idle(dev
, priv
);
537 static int crb_acpi_add(struct acpi_device
*device
)
539 struct acpi_table_tpm2
*buf
;
540 struct crb_priv
*priv
;
541 struct tpm_chip
*chip
;
542 struct device
*dev
= &device
->dev
;
543 struct tpm2_crb_smc
*crb_smc
;
548 status
= acpi_get_table(ACPI_SIG_TPM2
, 1,
549 (struct acpi_table_header
**) &buf
);
550 if (ACPI_FAILURE(status
) || buf
->header
.length
< sizeof(*buf
)) {
551 dev_err(dev
, FW_BUG
"failed to get TPM2 ACPI table\n");
555 /* Should the FIFO driver handle this? */
556 sm
= buf
->start_method
;
557 if (sm
== ACPI_TPM2_MEMORY_MAPPED
)
560 priv
= devm_kzalloc(dev
, sizeof(struct crb_priv
), GFP_KERNEL
);
564 if (sm
== ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC
) {
565 if (buf
->header
.length
< (sizeof(*buf
) + sizeof(*crb_smc
))) {
567 FW_BUG
"TPM2 ACPI table has wrong size %u for start method type %d\n",
569 ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC
);
572 crb_smc
= ACPI_ADD_PTR(struct tpm2_crb_smc
, buf
, sizeof(*buf
));
573 priv
->smc_func_id
= crb_smc
->smc_func_id
;
577 priv
->hid
= acpi_device_hid(device
);
579 rc
= crb_map_io(device
, priv
, buf
);
583 chip
= tpmm_chip_alloc(dev
, &tpm_crb
);
585 return PTR_ERR(chip
);
587 dev_set_drvdata(&chip
->dev
, priv
);
588 chip
->acpi_dev_handle
= device
->handle
;
589 chip
->flags
= TPM_CHIP_FLAG_TPM2
;
591 rc
= crb_cmd_ready(dev
, priv
);
595 pm_runtime_get_noresume(dev
);
596 pm_runtime_set_active(dev
);
597 pm_runtime_enable(dev
);
599 rc
= tpm_chip_register(chip
);
601 crb_go_idle(dev
, priv
);
602 pm_runtime_put_noidle(dev
);
603 pm_runtime_disable(dev
);
612 static int crb_acpi_remove(struct acpi_device
*device
)
614 struct device
*dev
= &device
->dev
;
615 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
617 tpm_chip_unregister(chip
);
619 pm_runtime_disable(dev
);
624 static int __maybe_unused
crb_pm_runtime_suspend(struct device
*dev
)
626 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
627 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
629 return crb_go_idle(dev
, priv
);
632 static int __maybe_unused
crb_pm_runtime_resume(struct device
*dev
)
634 struct tpm_chip
*chip
= dev_get_drvdata(dev
);
635 struct crb_priv
*priv
= dev_get_drvdata(&chip
->dev
);
637 return crb_cmd_ready(dev
, priv
);
640 static int __maybe_unused
crb_pm_suspend(struct device
*dev
)
644 ret
= tpm_pm_suspend(dev
);
648 return crb_pm_runtime_suspend(dev
);
651 static int __maybe_unused
crb_pm_resume(struct device
*dev
)
655 ret
= crb_pm_runtime_resume(dev
);
659 return tpm_pm_resume(dev
);
662 static const struct dev_pm_ops crb_pm
= {
663 SET_SYSTEM_SLEEP_PM_OPS(crb_pm_suspend
, crb_pm_resume
)
664 SET_RUNTIME_PM_OPS(crb_pm_runtime_suspend
, crb_pm_runtime_resume
, NULL
)
667 static const struct acpi_device_id crb_device_ids
[] = {
671 MODULE_DEVICE_TABLE(acpi
, crb_device_ids
);
673 static struct acpi_driver crb_acpi_driver
= {
675 .ids
= crb_device_ids
,
678 .remove
= crb_acpi_remove
,
685 module_acpi_driver(crb_acpi_driver
);
686 MODULE_AUTHOR("Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>");
687 MODULE_DESCRIPTION("TPM2 Driver");
688 MODULE_VERSION("0.1");
689 MODULE_LICENSE("GPL");