1// SPDX-License-Identifier: GPL-2.0+
2/*
3 * Copyright (c) 2011 The Chromium OS Authors.
4 */
5
6/*
7 * The code in this file is based on the article "Writing a TPM Device Driver"
8 * published on http://ptgmedia.pearsoncmg.com.
9 *
10 * One principal difference is that in the simplest config the other than 0
11 * TPM localities do not get mapped by some devices (for instance, by Infineon
12 * slb9635), so this driver provides access to locality 0 only.
13 */
14
15#include <common.h>
16#include <dm.h>
17#include <log.h>
18#include <mapmem.h>
19#include <tpm-v1.h>
20#include <asm/io.h>
21#include <linux/delay.h>
22
23#define PREFIX "lpc_tpm: "
24
25enum i2c_chip_type {
26	SLB9635,
27	AT97SC3204,
28};
29
30static const char * const chip_name[] = {
31	[SLB9635] = "Infineon SLB9635 TT 1.2",
32	[AT97SC3204] = "Atmel AT97SC3204",
33};
34
35static const u32 chip_didvid[] = {
36	[SLB9635] = 0xb15d1,
37	[AT97SC3204] = 0x32041114,
38};
39
40struct tpm_locality {
41	u32 access;
42	u8 padding0[4];
43	u32 int_enable;
44	u8 vector;
45	u8 padding1[3];
46	u32 int_status;
47	u32 int_capability;
48	u32 tpm_status;
49	u8 padding2[8];
50	u8 data;
51	u8 padding3[3803];
52	u32 did_vid;
53	u8 rid;
54	u8 padding4[251];
55};
56
57struct tpm_tis_lpc_priv {
58	struct tpm_locality *regs;
59};
60
61/*
62 * This pointer refers to the TPM chip, 5 of its localities are mapped as an
63 * array.
64 */
65#define TPM_TOTAL_LOCALITIES	5
66
67/* Some registers' bit field definitions */
68#define TIS_STS_VALID                  (1 << 7) /* 0x80 */
69#define TIS_STS_COMMAND_READY          (1 << 6) /* 0x40 */
70#define TIS_STS_TPM_GO                 (1 << 5) /* 0x20 */
71#define TIS_STS_DATA_AVAILABLE         (1 << 4) /* 0x10 */
72#define TIS_STS_EXPECT                 (1 << 3) /* 0x08 */
73#define TIS_STS_RESPONSE_RETRY         (1 << 1) /* 0x02 */
74
75#define TIS_ACCESS_TPM_REG_VALID_STS   (1 << 7) /* 0x80 */
76#define TIS_ACCESS_ACTIVE_LOCALITY     (1 << 5) /* 0x20 */
77#define TIS_ACCESS_BEEN_SEIZED         (1 << 4) /* 0x10 */
78#define TIS_ACCESS_SEIZE               (1 << 3) /* 0x08 */
79#define TIS_ACCESS_PENDING_REQUEST     (1 << 2) /* 0x04 */
80#define TIS_ACCESS_REQUEST_USE         (1 << 1) /* 0x02 */
81#define TIS_ACCESS_TPM_ESTABLISHMENT   (1 << 0) /* 0x01 */
82
83#define TIS_STS_BURST_COUNT_MASK       (0xffff)
84#define TIS_STS_BURST_COUNT_SHIFT      (8)
85
86 /* 1 second is plenty for anything TPM does. */
87#define MAX_DELAY_US	(1000 * 1000)
88
89/* Retrieve burst count value out of the status register contents. */
90static u16 burst_count(u32 status)
91{
92	return (status >> TIS_STS_BURST_COUNT_SHIFT) &
93			TIS_STS_BURST_COUNT_MASK;
94}
95
96/* TPM access wrappers to support tracing */
97static u8 tpm_read_byte(struct tpm_tis_lpc_priv *priv, const u8 *ptr)
98{
99	u8  ret = readb(ptr);
100	debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n",
101	      (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
102	return ret;
103}
104
105static u32 tpm_read_word(struct tpm_tis_lpc_priv *priv, const u32 *ptr)
106{
107	u32  ret = readl(ptr);
108	debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n",
109	      (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
110	return ret;
111}
112
113static void tpm_write_byte(struct tpm_tis_lpc_priv *priv, u8 value, u8 *ptr)
114{
115	debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n",
116	      (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
117	writeb(value, ptr);
118}
119
120static void tpm_write_word(struct tpm_tis_lpc_priv *priv, u32 value,
121			   u32 *ptr)
122{
123	debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n",
124	      (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
125	writel(value, ptr);
126}
127
128/*
129 * tis_wait_reg()
130 *
131 * Wait for at least a second for a register to change its state to match the
132 * expected state. Normally the transition happens within microseconds.
133 *
134 * @reg - pointer to the TPM register
135 * @mask - bitmask for the bitfield(s) to watch
136 * @expected - value the field(s) are supposed to be set to
137 *
138 * Returns the register contents in case the expected value was found in the
139 * appropriate register bits, or -ETIMEDOUT on timeout.
140 */
141static int tis_wait_reg(struct tpm_tis_lpc_priv *priv, u32 *reg, u8 mask,
142			u8 expected)
143{
144	u32 time_us = MAX_DELAY_US;
145
146	while (time_us > 0) {
147		u32 value = tpm_read_word(priv, reg);
148		if ((value & mask) == expected)
149			return value;
150		udelay(1); /* 1 us */
151		time_us--;
152	}
153
154	return -ETIMEDOUT;
155}
156
157/*
158 * Probe the TPM device and try determining its manufacturer/device name.
159 *
160 * Returns 0 on success, -ve on error
161 */
162static int tpm_tis_lpc_probe(struct udevice *dev)
163{
164	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
165	fdt_addr_t addr;
166	u32 didvid;
167	ulong chip_type = dev_get_driver_data(dev);
168
169	addr = dev_read_addr(dev);
170	if (addr == FDT_ADDR_T_NONE)
171		return -EINVAL;
172	priv->regs = map_sysmem(addr, 0);
173	didvid = tpm_read_word(priv, &priv->regs[0].did_vid);
174
175	if (didvid != chip_didvid[chip_type]) {
176		u32 vid, did;
177		vid = didvid & 0xffff;
178		did = (didvid >> 16) & 0xffff;
179		debug("Invalid vendor/device ID %04x/%04x\n", vid, did);
180		return -ENODEV;
181	}
182
183	debug("Found TPM: %s\n", chip_name[chip_type]);
184
185	return 0;
186}
187
188/*
189 * tis_senddata()
190 *
191 * send the passed in data to the TPM device.
192 *
193 * @data - address of the data to send, byte by byte
194 * @len - length of the data to send
195 *
196 * Returns 0 on success, -ve on error (in case the device does not accept
197 * the entire command).
198 */
199static int tis_senddata(struct udevice *dev, const u8 *data, size_t len)
200{
201	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
202	struct tpm_locality *regs = priv->regs;
203	u32 offset = 0;
204	u16 burst = 0;
205	u32 max_cycles = 0;
206	u8 locality = 0;
207	u32 value;
208
209	value = tis_wait_reg(priv, &regs[locality].tpm_status,
210			     TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY);
211	if (value == -ETIMEDOUT) {
212		printf("%s:%d - failed to get 'command_ready' status\n",
213		       __FILE__, __LINE__);
214		return value;
215	}
216	burst = burst_count(value);
217
218	while (1) {
219		unsigned count;
220
221		/* Wait till the device is ready to accept more data. */
222		while (!burst) {
223			if (max_cycles++ == MAX_DELAY_US) {
224				printf("%s:%d failed to feed %zd bytes of %zd\n",
225				       __FILE__, __LINE__, len - offset, len);
226				return -ETIMEDOUT;
227			}
228			udelay(1);
229			burst = burst_count(tpm_read_word(priv,
230					&regs[locality].tpm_status));
231		}
232
233		max_cycles = 0;
234
235		/*
236		 * Calculate number of bytes the TPM is ready to accept in one
237		 * shot.
238		 *
239		 * We want to send the last byte outside of the loop (hence
240		 * the -1 below) to make sure that the 'expected' status bit
241		 * changes to zero exactly after the last byte is fed into the
242		 * FIFO.
243		 */
244		count = min((size_t)burst, len - offset - 1);
245		while (count--)
246			tpm_write_byte(priv, data[offset++],
247				       &regs[locality].data);
248
249		value = tis_wait_reg(priv, &regs[locality].tpm_status,
250				     TIS_STS_VALID, TIS_STS_VALID);
251
252		if ((value == -ETIMEDOUT) || !(value & TIS_STS_EXPECT)) {
253			printf("%s:%d TPM command feed overflow\n",
254			       __FILE__, __LINE__);
255			return value == -ETIMEDOUT ? value : -EIO;
256		}
257
258		burst = burst_count(value);
259		if ((offset == (len - 1)) && burst) {
260			/*
261			 * We need to be able to send the last byte to the
262			 * device, so burst size must be nonzero before we
263			 * break out.
264			 */
265			break;
266		}
267	}
268
269	/* Send the last byte. */
270	tpm_write_byte(priv, data[offset++], &regs[locality].data);
271	/*
272	 * Verify that TPM does not expect any more data as part of this
273	 * command.
274	 */
275	value = tis_wait_reg(priv, &regs[locality].tpm_status,
276			     TIS_STS_VALID, TIS_STS_VALID);
277	if ((value == -ETIMEDOUT) || (value & TIS_STS_EXPECT)) {
278		printf("%s:%d unexpected TPM status 0x%x\n",
279		       __FILE__, __LINE__, value);
280		return value == -ETIMEDOUT ? value : -EIO;
281	}
282
283	/* OK, sitting pretty, let's start the command execution. */
284	tpm_write_word(priv, TIS_STS_TPM_GO, &regs[locality].tpm_status);
285	return 0;
286}
287
288/*
289 * tis_readresponse()
290 *
291 * read the TPM device response after a command was issued.
292 *
293 * @buffer - address where to read the response, byte by byte.
294 * @len - pointer to the size of buffer
295 *
296 * On success stores the number of received bytes to len and returns 0. On
297 * errors (misformatted TPM data or synchronization problems) returns
298 * -ve value.
299 */
300static int tis_readresponse(struct udevice *dev, u8 *buffer, size_t len)
301{
302	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
303	struct tpm_locality *regs = priv->regs;
304	u16 burst;
305	u32 value;
306	u32 offset = 0;
307	u8 locality = 0;
308	const u32 has_data = TIS_STS_DATA_AVAILABLE | TIS_STS_VALID;
309	u32 expected_count = len;
310	int max_cycles = 0;
311
312	/* Wait for the TPM to process the command. */
313	value = tis_wait_reg(priv, &regs[locality].tpm_status,
314			      has_data, has_data);
315	if (value == -ETIMEDOUT) {
316		printf("%s:%d failed processing command\n",
317		       __FILE__, __LINE__);
318		return value;
319	}
320
321	do {
322		while ((burst = burst_count(value)) == 0) {
323			if (max_cycles++ == MAX_DELAY_US) {
324				printf("%s:%d TPM stuck on read\n",
325				       __FILE__, __LINE__);
326				return -EIO;
327			}
328			udelay(1);
329			value = tpm_read_word(priv, &regs[locality].tpm_status);
330		}
331
332		max_cycles = 0;
333
334		while (burst-- && (offset < expected_count)) {
335			buffer[offset++] = tpm_read_byte(priv,
336						&regs[locality].data);
337
338			if (offset == 6) {
339				/*
340				 * We got the first six bytes of the reply,
341				 * let's figure out how many bytes to expect
342				 * total - it is stored as a 4 byte number in
343				 * network order, starting with offset 2 into
344				 * the body of the reply.
345				 */
346				u32 real_length;
347				memcpy(&real_length,
348				       buffer + 2,
349				       sizeof(real_length));
350				expected_count = be32_to_cpu(real_length);
351
352				if ((expected_count < offset) ||
353				    (expected_count > len)) {
354					printf("%s:%d bad response size %d\n",
355					       __FILE__, __LINE__,
356					       expected_count);
357					return -ENOSPC;
358				}
359			}
360		}
361
362		/* Wait for the next portion. */
363		value = tis_wait_reg(priv, &regs[locality].tpm_status,
364				     TIS_STS_VALID, TIS_STS_VALID);
365		if (value == -ETIMEDOUT) {
366			printf("%s:%d failed to read response\n",
367			       __FILE__, __LINE__);
368			return value;
369		}
370
371		if (offset == expected_count)
372			break;	/* We got all we needed. */
373
374	} while ((value & has_data) == has_data);
375
376	/*
377	 * Make sure we indeed read all there was. The TIS_STS_VALID bit is
378	 * known to be set.
379	 */
380	if (value & TIS_STS_DATA_AVAILABLE) {
381		printf("%s:%d wrong receive status %x\n",
382		       __FILE__, __LINE__, value);
383		return -EBADMSG;
384	}
385
386	/* Tell the TPM that we are done. */
387	tpm_write_word(priv, TIS_STS_COMMAND_READY,
388		       &regs[locality].tpm_status);
389
390	return offset;
391}
392
393static int tpm_tis_lpc_close(struct udevice *dev)
394{
395	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
396	struct tpm_locality *regs = priv->regs;
397	u8 locality = 0;
398
399	if (tpm_read_word(priv, &regs[locality].access) &
400	    TIS_ACCESS_ACTIVE_LOCALITY) {
401		tpm_write_word(priv, TIS_ACCESS_ACTIVE_LOCALITY,
402			       &regs[locality].access);
403
404		if (tis_wait_reg(priv, &regs[locality].access,
405				 TIS_ACCESS_ACTIVE_LOCALITY, 0) == -ETIMEDOUT) {
406			printf("%s:%d - failed to release locality %d\n",
407			       __FILE__, __LINE__, locality);
408			return -ETIMEDOUT;
409		}
410	}
411	return 0;
412}
413
414static int tpm_tis_lpc_open(struct udevice *dev)
415{
416	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
417	struct tpm_locality *regs = priv->regs;
418	u8 locality = 0; /* we use locality zero for everything. */
419	int ret;
420
421	ret = tpm_tis_lpc_close(dev);
422	if (ret) {
423		printf("%s: Failed to close TPM\n", __func__);
424		return ret;
425	}
426
427	/* now request access to locality. */
428	tpm_write_word(priv, TIS_ACCESS_REQUEST_USE, &regs[locality].access);
429
430	/* did we get a lock? */
431	ret = tis_wait_reg(priv, &regs[locality].access,
432			 TIS_ACCESS_ACTIVE_LOCALITY,
433			 TIS_ACCESS_ACTIVE_LOCALITY);
434	if (ret == -ETIMEDOUT) {
435		printf("%s:%d - failed to lock locality %d\n",
436		       __FILE__, __LINE__, locality);
437		return ret;
438	}
439
440	tpm_write_word(priv, TIS_STS_COMMAND_READY,
441		       &regs[locality].tpm_status);
442
443	return 0;
444}
445
446static int tpm_tis_lpc_get_desc(struct udevice *dev, char *buf, int size)
447{
448	ulong chip_type = dev_get_driver_data(dev);
449
450	if (size < 50)
451		return -ENOSPC;
452
453	return snprintf(buf, size, "1.2 TPM (%s)",
454			chip_name[chip_type]);
455}
456
457
458static const struct tpm_ops tpm_tis_lpc_ops = {
459	.open		= tpm_tis_lpc_open,
460	.close		= tpm_tis_lpc_close,
461	.get_desc	= tpm_tis_lpc_get_desc,
462	.send		= tis_senddata,
463	.recv		= tis_readresponse,
464};
465
466static const struct udevice_id tpm_tis_lpc_ids[] = {
467	{ .compatible = "infineon,slb9635lpc", .data = SLB9635 },
468	{ .compatible = "atmel,at97sc3204", .data = AT97SC3204 },
469	{ }
470};
471
472U_BOOT_DRIVER(tpm_tis_lpc) = {
473	.name   = "tpm_tis_lpc",
474	.id     = UCLASS_TPM,
475	.of_match = tpm_tis_lpc_ids,
476	.ops    = &tpm_tis_lpc_ops,
477	.probe	= tpm_tis_lpc_probe,
478	.priv_auto	= sizeof(struct tpm_tis_lpc_priv),
479};
480