xref: /freebsd/sys/dev/tpm/tpm.c (revision 5319035afacceaa267792ec193eb03fa51c972f7)
1 /*
2  * Copyright (c) 2008, 2009 Michael Shalayeff
3  * Copyright (c) 2009, 2010 Hans-Joerg Hoexer
4  * All rights reserved.
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN
15  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
16  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /* #define	TPM_DEBUG */
20 
21 #include <sys/param.h>
22 #include <sys/systm.h>
23 #include <sys/endian.h>
24 #include <sys/kernel.h>
25 #include <sys/malloc.h>
26 #include <sys/proc.h>
27 
28 #include <sys/module.h>
29 #include <sys/conf.h>
30 #include <sys/uio.h>
31 #include <sys/bus.h>
32 
33 #include <machine/bus.h>
34 #include <sys/rman.h>
35 #include <machine/resource.h>
36 
37 #include <machine/md_var.h>
38 
39 #include <isa/isareg.h>
40 #include <isa/isavar.h>
41 #include <dev/tpm/tpmvar.h>
42 
43 MALLOC_DEFINE(M_TPM, "tpm12_buffer", "buffer for TPM 1.2 responses");
44 
45 #define	TPM_BUFSIZ	1024
46 
47 #define TPM_HDRSIZE	10
48 
49 #define TPM_PARAM_SIZE	0x0001
50 
51 #define	TPM_TAG_RQU_COMMAND	0x00c1
52 #define	TPM_TAG_RSP_COMMAND	0x00c4
53 #define	TPM_ORD_SAVESTATE	0x00000098
54 #define	TPM_WARN_RETRY		0x00000800
55 
56 #define	TPM_SAVESTATE_RETRIES	50
57 #define	TPM_SAVESTATE_RETRY_MS	100
58 
59 #define IRQUNK	-1
60 
61 #define	TPM_ACCESS			0x0000	/* access register */
62 #define	TPM_ACCESS_ESTABLISHMENT	0x01	/* establishment */
63 #define	TPM_ACCESS_REQUEST_USE		0x02	/* request using locality */
64 #define	TPM_ACCESS_REQUEST_PENDING	0x04	/* pending request */
65 #define	TPM_ACCESS_SEIZE		0x08	/* request locality seize */
66 #define	TPM_ACCESS_SEIZED		0x10	/* locality has been seized */
67 #define	TPM_ACCESS_ACTIVE_LOCALITY	0x20	/* locality is active */
68 #define	TPM_ACCESS_VALID		0x80	/* bits are valid */
69 #define	TPM_ACCESS_BITS	\
70     "\020\01EST\02REQ\03PEND\04SEIZE\05SEIZED\06ACT\010VALID"
71 
72 #define	TPM_INTERRUPT_ENABLE	0x0008
73 #define	TPM_GLOBAL_INT_ENABLE	0x80000000	/* enable ints */
74 #define	TPM_CMD_READY_INT	0x00000080	/* cmd ready enable */
75 #define	TPM_INT_EDGE_FALLING	0x00000018
76 #define	TPM_INT_EDGE_RISING	0x00000010
77 #define	TPM_INT_LEVEL_LOW	0x00000008
78 #define	TPM_INT_LEVEL_HIGH	0x00000000
79 #define	TPM_LOCALITY_CHANGE_INT	0x00000004	/* locality change enable */
80 #define	TPM_STS_VALID_INT	0x00000002	/* int on TPM_STS_VALID is set */
81 #define	TPM_DATA_AVAIL_INT	0x00000001	/* int on TPM_STS_DATA_AVAIL is set */
82 #define	TPM_INTERRUPT_ENABLE_BITS \
83     "\020\040ENA\010RDY\03LOCH\02STSV\01DRDY"
84 
85 #define	TPM_INT_VECTOR		0x000c	/* 8 bit reg for 4 bit irq vector */
86 #define	TPM_INT_STATUS		0x0010	/* bits are & 0x87 from TPM_INTERRUPT_ENABLE */
87 
88 #define	TPM_INTF_CAPABILITIES		0x0014	/* capability register */
89 #define	TPM_INTF_BURST_COUNT_STATIC	0x0100	/* TPM_STS_BMASK static */
90 #define	TPM_INTF_CMD_READY_INT		0x0080	/* int on ready supported */
91 #define	TPM_INTF_INT_EDGE_FALLING	0x0040	/* falling edge ints supported */
92 #define	TPM_INTF_INT_EDGE_RISING	0x0020	/* rising edge ints supported */
93 #define	TPM_INTF_INT_LEVEL_LOW		0x0010	/* level-low ints supported */
94 #define	TPM_INTF_INT_LEVEL_HIGH		0x0008	/* level-high ints supported */
95 #define	TPM_INTF_LOCALITY_CHANGE_INT	0x0004	/* locality-change int (mb 1) */
96 #define	TPM_INTF_STS_VALID_INT		0x0002	/* TPM_STS_VALID int supported */
97 #define	TPM_INTF_DATA_AVAIL_INT		0x0001	/* TPM_STS_DATA_AVAIL int supported (mb 1) */
98 #define	TPM_CAPSREQ \
99   (TPM_INTF_DATA_AVAIL_INT|TPM_INTF_LOCALITY_CHANGE_INT|TPM_INTF_INT_LEVEL_LOW)
100 #define	TPM_CAPBITS \
101   "\020\01IDRDY\02ISTSV\03ILOCH\04IHIGH\05ILOW\06IEDGE\07IFALL\010IRDY\011BCST"
102 
103 #define	TPM_STS			0x0018		/* status register */
104 #define TPM_STS_MASK		0x000000ff	/* status bits */
105 #define	TPM_STS_BMASK		0x00ffff00	/* ro io burst size */
106 #define	TPM_STS_VALID		0x00000080	/* ro other bits are valid */
107 #define	TPM_STS_CMD_READY	0x00000040	/* rw chip/signal ready */
108 #define	TPM_STS_GO		0x00000020	/* wo start the command */
109 #define	TPM_STS_DATA_AVAIL	0x00000010	/* ro data available */
110 #define	TPM_STS_DATA_EXPECT	0x00000008	/* ro more data to be written */
111 #define	TPM_STS_RESP_RETRY	0x00000002	/* wo resend the response */
112 #define	TPM_STS_BITS	"\020\010VALID\07RDY\06GO\05DRDY\04EXPECT\02RETRY"
113 
114 #define	TPM_DATA	0x0024
115 #define	TPM_ID		0x0f00
116 #define	TPM_REV		0x0f04
117 #define	TPM_SIZE	0x5000		/* five pages of the above */
118 
119 #define	TPM_ACCESS_TMO	2000		/* 2sec */
120 #define	TPM_READY_TMO	2000		/* 2sec */
121 #define	TPM_READ_TMO	120000		/* 2 minutes */
122 #define TPM_BURST_TMO	2000		/* 2sec */
123 
124 #define	TPM_LEGACY_BUSY	0x01
125 #define	TPM_LEGACY_ABRT	0x01
126 #define	TPM_LEGACY_DA	0x02
127 #define	TPM_LEGACY_RE	0x04
128 #define	TPM_LEGACY_LAST	0x04
129 #define	TPM_LEGACY_BITS	"\020\01BUSY\2DA\3RE\4LAST"
130 #define	TPM_LEGACY_TMO		(2*60)	/* sec */
131 #define	TPM_LEGACY_SLEEP	5	/* ticks */
132 #define	TPM_LEGACY_DELAY	100
133 
134 /* Set when enabling legacy interface in host bridge. */
135 int tpm_enabled;
136 
137 #define	TPMSOFTC(dev) \
138 	((struct tpm_softc *)dev->si_drv1)
139 
140 d_open_t	tpmopen;
141 d_close_t	tpmclose;
142 d_read_t	tpmread;
143 d_write_t	tpmwrite;
144 d_ioctl_t	tpmioctl;
145 
146 static struct cdevsw tpm_cdevsw = {
147 	.d_version =	D_VERSION,
148 	.d_open =	tpmopen,
149 	.d_close =	tpmclose,
150 	.d_read =	tpmread,
151 	.d_write =	tpmwrite,
152 	.d_ioctl =	tpmioctl,
153 	.d_name =	"tpm",
154 };
155 
156 const struct {
157 	u_int32_t devid;
158 	char name[32];
159 	int flags;
160 #define TPM_DEV_NOINTS	0x0001
161 } tpm_devs[] = {
162 	{ 0x000615d1, "IFX SLD 9630 TT 1.1", 0 },
163 	{ 0x000b15d1, "IFX SLB 9635 TT 1.2", 0 },
164 	{ 0x100214e4, "Broadcom BCM0102", TPM_DEV_NOINTS },
165 	{ 0x00fe1050, "WEC WPCT200", 0 },
166 	{ 0x687119fa, "SNS SSX35", 0 },
167 	{ 0x2e4d5453, "STM ST19WP18", 0 },
168 	{ 0x32021114, "ATML 97SC3203", TPM_DEV_NOINTS },
169 	{ 0x10408086, "INTEL INTC0102", 0 },
170 	{ 0, "", TPM_DEV_NOINTS },
171 };
172 
173 int tpm_tis12_irqinit(struct tpm_softc *, int, int);
174 int tpm_tis12_init(struct tpm_softc *, int, const char *);
175 int tpm_tis12_start(struct tpm_softc *, int);
176 int tpm_tis12_read(struct tpm_softc *, void *, int, size_t *, int);
177 int tpm_tis12_write(struct tpm_softc *, void *, int);
178 int tpm_tis12_end(struct tpm_softc *, int, int);
179 
180 void tpm_intr(void *);
181 
182 int tpm_waitfor_poll(struct tpm_softc *, u_int8_t, int, void *);
183 int tpm_waitfor_int(struct tpm_softc *, u_int8_t, int, int);
184 int tpm_waitfor(struct tpm_softc *, u_int8_t, int, void *);
185 int tpm_request_locality(struct tpm_softc *, int);
186 int tpm_getburst(struct tpm_softc *);
187 u_int8_t tpm_status(struct tpm_softc *);
188 int tpm_tmotohz(int);
189 
190 int tpm_legacy_probe(bus_space_tag_t, bus_addr_t);
191 int tpm_legacy_init(struct tpm_softc *, int, const char *);
192 int tpm_legacy_start(struct tpm_softc *, int);
193 int tpm_legacy_read(struct tpm_softc *, void *, int, size_t *, int);
194 int tpm_legacy_write(struct tpm_softc *, void *, int);
195 int tpm_legacy_end(struct tpm_softc *, int, int);
196 
197 static int tpm_transmit_header(struct tpm_softc *, uint32_t, uint32_t *);
198 static void tpm_tis12_abort(struct tpm_softc *);
199 static int tpm_tis12_devid_index(uint32_t);
200 static void tpm_tis12_relinquish_locality(struct tpm_softc *);
201 static int tpm_tis12_resume(struct tpm_softc *);
202 
203 
204 /*
205  * FreeBSD specific code for probing and attaching TPM to device tree.
206  */
207 #if 0
208 static void
209 tpm_identify(driver_t *driver, device_t parent)
210 {
211 	BUS_ADD_CHILD(parent, ISA_ORDER_SPECULATIVE, "tpm", 0);
212 }
213 #endif
214 
215 int
tpm_attach(device_t dev)216 tpm_attach(device_t dev)
217 {
218 	struct make_dev_args args;
219 	struct tpm_softc *sc;
220 	int error, irq;
221 
222 	sc = device_get_softc(dev);
223 	sx_init(&sc->sc_lock, "TPM driver lock");
224 	mtx_init(&sc->sc_intr_lock, "TPM interrupt lock", NULL, MTX_DEF);
225 	cv_init(&sc->sc_intr_cv, "tpm_intr");
226 	sc->intr_cookie = NULL;
227 	sc->sc_cdev = NULL;
228 	sc->sc_flags = 0;
229 	sc->sc_suspend = 0;
230 	sc->sc_dying = false;
231 	sc->sc_locality = false;
232 	sc->sc_command_pending = false;
233 
234 	sc->mem_rid = 0;
235 	sc->mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
236 	    RF_ACTIVE);
237 	if (sc->mem_res == NULL) {
238 		error = ENXIO;
239 		goto fail;
240 	}
241 
242 	sc->sc_bt = rman_get_bustag(sc->mem_res);
243 	sc->sc_bh = rman_get_bushandle(sc->mem_res);
244 
245 	sc->irq_rid = 0;
246 	sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
247 	    RF_ACTIVE | RF_SHAREABLE);
248 	if (sc->irq_res != NULL)
249 		irq = rman_get_start(sc->irq_res);
250 	else
251 		irq = IRQUNK;
252 
253 	if (tpm_legacy_probe(sc->sc_bt, sc->sc_bh)) {
254 		sc->sc_init = tpm_legacy_init;
255 		sc->sc_start = tpm_legacy_start;
256 		sc->sc_read = tpm_legacy_read;
257 		sc->sc_write = tpm_legacy_write;
258 		sc->sc_end = tpm_legacy_end;
259 	} else {
260 		sc->sc_init = tpm_tis12_init;
261 		sc->sc_start = tpm_tis12_start;
262 		sc->sc_read = tpm_tis12_read;
263 		sc->sc_write = tpm_tis12_write;
264 		sc->sc_end = tpm_tis12_end;
265 	}
266 
267 	printf("%s", device_get_name(dev));
268 	sx_xlock(&sc->sc_lock);
269 	error = sc->sc_init(sc, irq, "tpm");
270 	sx_xunlock(&sc->sc_lock);
271 	if (error != 0) {
272 		error = ENXIO;
273 		goto fail;
274 	}
275 
276 	if (sc->sc_init == tpm_tis12_init && sc->irq_res != NULL &&
277 	    bus_setup_intr(dev, sc->irq_res, INTR_TYPE_TTY | INTR_MPSAFE, NULL,
278 	    tpm_intr, sc, &sc->intr_cookie) != 0) {
279 		printf(": cannot establish interrupt\n");
280 		error = ENXIO;
281 		goto fail;
282 	}
283 
284 	make_dev_args_init(&args);
285 	args.mda_devsw = &tpm_cdevsw;
286 	args.mda_unit = device_get_unit(dev);
287 	args.mda_uid = UID_ROOT;
288 	args.mda_gid = GID_WHEEL;
289 	args.mda_mode = 0600;
290 	args.mda_si_drv1 = sc;
291 	error = make_dev_s(&args, &sc->sc_cdev, "tpm");
292 	if (error != 0)
293 		goto fail;
294 
295 	return (0);
296 
297 fail:
298 	tpm_detach(dev);
299 	return (error);
300 }
301 
302 int
tpm_detach(device_t dev)303 tpm_detach(device_t dev)
304 {
305 	struct tpm_softc *sc;
306 
307 	sc = device_get_softc(dev);
308 	sx_xlock(&sc->sc_lock);
309 	sc->sc_dying = true;
310 	sx_xunlock(&sc->sc_lock);
311 
312 	/*
313 	 * Prevent new methods from touching the transport.  Do not hold the
314 	 * lock while destroy_dev() drains methods already waiting for it.
315 	 */
316 	if (sc->sc_cdev != NULL) {
317 		destroy_dev(sc->sc_cdev);
318 		sc->sc_cdev = NULL;
319 	}
320 	sx_xlock(&sc->sc_lock);
321 	if (sc->mem_res != NULL && sc->sc_init == tpm_tis12_init)
322 		tpm_tis12_abort(sc);
323 	sx_xunlock(&sc->sc_lock);
324 	if (sc->intr_cookie != NULL) {
325 		bus_teardown_intr(dev, sc->irq_res, sc->intr_cookie);
326 		sc->intr_cookie = NULL;
327 	}
328 	if (sc->mem_res != NULL) {
329 		bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid,
330 		    sc->mem_res);
331 		sc->mem_res = NULL;
332 	}
333 	if (sc->irq_res != NULL) {
334 		bus_release_resource(dev, SYS_RES_IRQ,
335 		    sc->irq_rid, sc->irq_res);
336 		sc->irq_res = NULL;
337 	}
338 	cv_destroy(&sc->sc_intr_cv);
339 	mtx_destroy(&sc->sc_intr_lock);
340 	sx_destroy(&sc->sc_lock);
341 
342 	return (0);
343 }
344 
345 /* Probe TPM using TIS 1.2 interface. */
346 int
tpm_tis12_probe(bus_space_tag_t bt,bus_space_handle_t bh)347 tpm_tis12_probe(bus_space_tag_t bt, bus_space_handle_t bh)
348 {
349 	u_int32_t r;
350 	u_int8_t reg;
351 	bool acquired;
352 	int to;
353 
354 	r = bus_space_read_4(bt, bh, TPM_INTF_CAPABILITIES);
355 	if (r == 0xffffffff)
356 		return 0;
357 
358 #ifdef TPM_DEBUG
359 	printf("tpm: caps=%b\n", r, TPM_CAPBITS);
360 #endif
361 	if ((r & TPM_CAPSREQ) != TPM_CAPSREQ ||
362 	    !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) {
363 #ifdef TPM_DEBUG
364 		printf("tpm: caps too low (caps=%b)\n", r, TPM_CAPBITS);
365 #endif
366 		return 0;
367 	}
368 
369 	reg = bus_space_read_1(bt, bh, TPM_ACCESS);
370 	acquired = false;
371 	if ((reg & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
372 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
373 		bus_space_write_1(bt, bh, TPM_ACCESS,
374 		    TPM_ACCESS_REQUEST_USE);
375 		to = TPM_ACCESS_TMO;	/* Steps of one millisecond. */
376 		do {
377 			reg = bus_space_read_1(bt, bh, TPM_ACCESS);
378 			if ((reg & (TPM_ACCESS_VALID |
379 			    TPM_ACCESS_ACTIVE_LOCALITY)) ==
380 			    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
381 				acquired = true;
382 				break;
383 			}
384 			DELAY(1000);
385 		} while (--to != 0);
386 	}
387 
388 	if ((reg & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) ==
389 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY))
390 		r = bus_space_read_4(bt, bh, TPM_ID);
391 	else
392 		r = UINT32_MAX;
393 	if (acquired)
394 		bus_space_write_1(bt, bh, TPM_ACCESS,
395 		    TPM_ACCESS_ACTIVE_LOCALITY);
396 	return (r != UINT32_MAX);
397 }
398 
399 /*
400  * Setup the interrupt vector if one is provided and interrupts are known
401  * to work on that particular chip.  The caller must hold locality zero.
402  */
403 int
tpm_tis12_irqinit(struct tpm_softc * sc,int irq,int idx)404 tpm_tis12_irqinit(struct tpm_softc *sc, int irq, int idx)
405 {
406 	u_int32_t r;
407 
408 	sx_assert(&sc->sc_lock, SA_XLOCKED);
409 	mtx_lock(&sc->sc_intr_lock);
410 
411 	/* Ack and disable all interrupts. */
412 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
413 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
414 	    ~TPM_GLOBAL_INT_ENABLE);
415 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS,
416 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS));
417 
418 	if ((irq == IRQUNK) || (tpm_devs[idx].flags & TPM_DEV_NOINTS)) {
419 		sc->sc_vector = IRQUNK;
420 		mtx_unlock(&sc->sc_intr_lock);
421 		return (0);
422 	}
423 
424 	/* Program interrupt vector. */
425 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_INT_VECTOR, irq);
426 	sc->sc_vector = irq;
427 
428 	/* Program interrupt type. */
429 	if (sc->sc_capabilities & TPM_INTF_INT_EDGE_RISING)
430 		r = TPM_INT_EDGE_RISING;
431 	else if (sc->sc_capabilities & TPM_INTF_INT_LEVEL_HIGH)
432 		r = TPM_INT_LEVEL_HIGH;
433 	else
434 		r = TPM_INT_LEVEL_LOW;
435 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, r);
436 
437 	mtx_unlock(&sc->sc_intr_lock);
438 	return (0);
439 }
440 
441 static int
tpm_tis12_devid_index(uint32_t devid)442 tpm_tis12_devid_index(uint32_t devid)
443 {
444 	int i;
445 
446 	for (i = 0; tpm_devs[i].devid != 0; i++)
447 		if (tpm_devs[i].devid == devid)
448 			break;
449 	return (i);
450 }
451 
452 /* Setup TPM using TIS 1.2 interface. */
453 int
tpm_tis12_init(struct tpm_softc * sc,int irq,const char * name)454 tpm_tis12_init(struct tpm_softc *sc, int irq, const char *name)
455 {
456 	u_int32_t r;
457 	int error, i;
458 
459 	sx_assert(&sc->sc_lock, SA_XLOCKED);
460 	r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTF_CAPABILITIES);
461 #ifdef TPM_DEBUG
462 	printf(" caps=%b ", r, TPM_CAPBITS);
463 #endif
464 	if ((r & TPM_CAPSREQ) != TPM_CAPSREQ ||
465 	    !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) {
466 		printf(": capabilities too low (caps=%b)\n", r, TPM_CAPBITS);
467 		return 1;
468 	}
469 	sc->sc_capabilities = r;
470 
471 	sc->sc_devid = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_ID);
472 	sc->sc_rev = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_REV);
473 
474 	i = tpm_tis12_devid_index(sc->sc_devid);
475 
476 	if (tpm_devs[i].devid)
477 		printf(": %s rev 0x%x\n", tpm_devs[i].name, sc->sc_rev);
478 	else
479 		printf(": device 0x%08x rev 0x%x\n", sc->sc_devid, sc->sc_rev);
480 
481 	error = tpm_request_locality(sc, 0);
482 	if (error != 0)
483 		return 1;
484 
485 	error = tpm_tis12_irqinit(sc, irq, i);
486 	if (error != 0)
487 		goto out;
488 
489 	/* Abort whatever it thought it was doing. */
490 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
491 	error = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO,
492 	    sc->sc_write);
493 
494 out:
495 	tpm_tis12_relinquish_locality(sc);
496 	return (error != 0);
497 }
498 
499 /* Restore TIS state which is not guaranteed to survive S3. */
500 static int
tpm_tis12_resume(struct tpm_softc * sc)501 tpm_tis12_resume(struct tpm_softc *sc)
502 {
503 	uint32_t capabilities, devid;
504 	int error, i, irq;
505 
506 	sx_assert(&sc->sc_lock, SA_XLOCKED);
507 	capabilities = bus_space_read_4(sc->sc_bt, sc->sc_bh,
508 	    TPM_INTF_CAPABILITIES);
509 	if ((capabilities & TPM_CAPSREQ) != TPM_CAPSREQ ||
510 	    (capabilities & (TPM_INTF_INT_EDGE_RISING |
511 	    TPM_INTF_INT_LEVEL_LOW)) == 0)
512 		return (ENXIO);
513 	devid = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_ID);
514 	if (devid == UINT32_MAX || devid != sc->sc_devid)
515 		return (ENXIO);
516 
517 	sc->sc_capabilities = capabilities;
518 	i = tpm_tis12_devid_index(devid);
519 	irq = sc->sc_vector;
520 	error = tpm_request_locality(sc, 0);
521 	if (error != 0)
522 		return (error);
523 	error = tpm_tis12_irqinit(sc, irq, i);
524 	if (error != 0)
525 		goto out;
526 
527 	/* Abort firmware residue and leave the command FIFO ready. */
528 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
529 	    TPM_STS_CMD_READY);
530 	error = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO,
531 	    sc->sc_write);
532 out:
533 	tpm_tis12_relinquish_locality(sc);
534 	return (error);
535 }
536 
537 int
tpm_request_locality(struct tpm_softc * sc,int l)538 tpm_request_locality(struct tpm_softc *sc, int l)
539 {
540 	u_int32_t r;
541 	int to, rv;
542 
543 	sx_assert(&sc->sc_lock, SA_XLOCKED);
544 	if (l != 0)
545 		return EINVAL;
546 	KASSERT(!sc->sc_locality, ("%s: locality already owned", __func__));
547 
548 	if ((bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
549 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) ==
550 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
551 		sc->sc_locality = true;
552 		return 0;
553 	}
554 	sc->sc_locality = false;
555 
556 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS,
557 	    TPM_ACCESS_REQUEST_USE);
558 
559 	to = tpm_tmotohz(TPM_ACCESS_TMO);
560 
561 	while ((r = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
562 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
563 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY) && to--) {
564 		rv = tsleep(sc->sc_init, PRIBIO | PCATCH, "tpm_locality", 1);
565 		if (rv &&  rv != EWOULDBLOCK) {
566 #ifdef TPM_DEBUG
567 			printf("tpm_request_locality: interrupted %d\n", rv);
568 #endif
569 			r = bus_space_read_1(sc->sc_bt, sc->sc_bh,
570 			    TPM_ACCESS);
571 			if ((r & (TPM_ACCESS_VALID |
572 			    TPM_ACCESS_ACTIVE_LOCALITY)) ==
573 			    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
574 				sc->sc_locality = true;
575 				tpm_tis12_relinquish_locality(sc);
576 			}
577 			return rv;
578 		}
579 	}
580 
581 	if ((r & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
582 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
583 #ifdef TPM_DEBUG
584 		printf("tpm_request_locality: access %b\n", r, TPM_ACCESS_BITS);
585 #endif
586 		return EBUSY;
587 	}
588 
589 	sc->sc_locality = true;
590 	return 0;
591 }
592 
593 static void
tpm_tis12_relinquish_locality(struct tpm_softc * sc)594 tpm_tis12_relinquish_locality(struct tpm_softc *sc)
595 {
596 
597 	sx_assert(&sc->sc_lock, SA_XLOCKED);
598 	sc->sc_command_pending = false;
599 	if (!sc->sc_locality)
600 		return;
601 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS,
602 	    TPM_ACCESS_ACTIVE_LOCALITY);
603 	sc->sc_locality = false;
604 }
605 
606 static void
tpm_tis12_abort(struct tpm_softc * sc)607 tpm_tis12_abort(struct tpm_softc *sc)
608 {
609 
610 	sx_assert(&sc->sc_lock, SA_XLOCKED);
611 	if (sc->sc_locality)
612 		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
613 		    TPM_STS_CMD_READY);
614 	tpm_tis12_relinquish_locality(sc);
615 }
616 
617 int
tpm_getburst(struct tpm_softc * sc)618 tpm_getburst(struct tpm_softc *sc)
619 {
620 	int burst, to, rv;
621 
622 	sx_assert(&sc->sc_lock, SA_XLOCKED);
623 	to = tpm_tmotohz(TPM_BURST_TMO);
624 
625 	burst = 0;
626 	while (burst == 0 && to--) {
627 		/*
628 		 * Burst count has to be read from bits 8 to 23 without
629 		 * touching any other bits, eg. the actual status bits 0
630 		 * to 7.
631 		 */
632 		burst = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 1);
633 		burst |= bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 2)
634 		    << 8;
635 #ifdef TPM_DEBUG
636 		printf("tpm_getburst: read %d\n", burst);
637 #endif
638 		if (burst)
639 			return burst;
640 
641 		rv = tsleep(sc, PRIBIO | PCATCH, "tpm_getburst", 1);
642 		if (rv && rv != EWOULDBLOCK) {
643 			return 0;
644 		}
645 	}
646 
647 	return 0;
648 }
649 
650 u_int8_t
tpm_status(struct tpm_softc * sc)651 tpm_status(struct tpm_softc *sc)
652 {
653 	u_int8_t status;
654 
655 	status = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS) &
656 	    TPM_STS_MASK;
657 
658 	return status;
659 }
660 
661 int
tpm_tmotohz(int tmo)662 tpm_tmotohz(int tmo)
663 {
664 	struct timeval tv;
665 
666 	tv.tv_sec = tmo / 1000;
667 	tv.tv_usec = 1000 * (tmo % 1000);
668 
669 	return tvtohz(&tv);
670 }
671 
672 /*
673  * Transmit a command with no parameters and consume its header-only reply.
674  */
675 static int
tpm_transmit_header(struct tpm_softc * sc,uint32_t ordinal,uint32_t * tpm_rc)676 tpm_transmit_header(struct tpm_softc *sc, uint32_t ordinal, uint32_t *tpm_rc)
677 {
678 	uint8_t buf[TPM_HDRSIZE];
679 	size_t count;
680 	int end_error, error;
681 
682 	sx_assert(&sc->sc_lock, SA_XLOCKED);
683 	be16enc(buf, TPM_TAG_RQU_COMMAND);
684 	be32enc(buf + 2, sizeof(buf));
685 	be32enc(buf + 6, ordinal);
686 
687 	error = sc->sc_start(sc, UIO_WRITE);
688 	if (error != 0)
689 		return (error);
690 	error = sc->sc_write(sc, buf, sizeof(buf));
691 	end_error = sc->sc_end(sc, UIO_WRITE, error);
692 	if (error == 0)
693 		error = end_error;
694 	if (error != 0)
695 		return (error);
696 
697 	error = sc->sc_start(sc, UIO_READ);
698 	if (error != 0)
699 		return (error);
700 	count = 0;
701 	error = sc->sc_read(sc, buf, sizeof(buf), &count, TPM_PARAM_SIZE);
702 	end_error = sc->sc_end(sc, UIO_READ, error);
703 	if (error == 0)
704 		error = end_error;
705 	if (error != 0)
706 		return (error);
707 
708 	if (count != sizeof(buf) || be16dec(buf) != TPM_TAG_RSP_COMMAND ||
709 	    be32dec(buf + 2) != sizeof(buf))
710 		return (EPROTO);
711 	*tpm_rc = be32dec(buf + 6);
712 	return (0);
713 }
714 
715 /* Save TPM state on suspend. */
716 int
tpm_suspend(device_t dev)717 tpm_suspend(device_t dev)
718 {
719 	struct tpm_softc *sc;
720 	uint32_t tpm_rc;
721 	int error, tries;
722 
723 	/*
724 	 * A TPM may report RETRY for several seconds when firmware issued
725 	 * SaveState before the driver loaded.  Any subsequent command can
726 	 * invalidate that saved state, so retry SaveState before entering S3.
727 	 */
728 	sc = device_get_softc(dev);
729 	sx_xlock(&sc->sc_lock);
730 	if (sc->sc_dying) {
731 		error = ENXIO;
732 		goto out;
733 	}
734 	if (sc->sc_suspend != 0) {
735 		error = 0;
736 		goto out;
737 	}
738 	for (tries = 0; tries < TPM_SAVESTATE_RETRIES; tries++) {
739 		error = tpm_transmit_header(sc, TPM_ORD_SAVESTATE, &tpm_rc);
740 		if (error != 0 || tpm_rc != TPM_WARN_RETRY)
741 			break;
742 		pause("tpmsave", MAX(hz * TPM_SAVESTATE_RETRY_MS / 1000, 1));
743 	}
744 	if (error != 0) {
745 		device_printf(dev, "failed to save state: %d\n", error);
746 		goto out;
747 	}
748 	if (tpm_rc != 0) {
749 		device_printf(dev, "SaveState failed: TPM error 0x%x\n",
750 		    tpm_rc);
751 		error = EIO;
752 		goto out;
753 	}
754 	if (tries != 0)
755 		device_printf(dev, "SaveState required %d retries\n", tries);
756 #ifdef TPM_DEBUG
757 	device_printf(dev, "suspend: %d -> 1\n", sc->sc_suspend);
758 #endif
759 	sc->sc_suspend = 1;
760 	error = 0;
761 
762 out:
763 	sx_xunlock(&sc->sc_lock);
764 	return (error);
765 }
766 
767 /* Handle resume after firmware has restored the saved TPM state. */
768 int
tpm_resume(device_t dev)769 tpm_resume(device_t dev)
770 {
771 	struct tpm_softc *sc;
772 	int error;
773 
774 	sc = device_get_softc(dev);
775 	sx_xlock(&sc->sc_lock);
776 	if (sc->sc_dying) {
777 		error = ENXIO;
778 		goto out;
779 	}
780 	error = 0;
781 	if (sc->sc_suspend != 0 && sc->sc_init == tpm_tis12_init)
782 		error = tpm_tis12_resume(sc);
783 #ifdef TPM_DEBUG
784 	device_printf(dev, "resume: %d -> 0\n", sc->sc_suspend);
785 #endif
786 	if (error == 0)
787 		sc->sc_suspend = 0;
788 	if (error != 0)
789 		device_printf(dev, "failed to restore TIS state: %d\n", error);
790 
791 out:
792 	sx_xunlock(&sc->sc_lock);
793 	return (error);
794 }
795 
796 /* Dispatch suspend and resume events. */
797 
798 /* Wait for given status bits using polling. */
799 int
tpm_waitfor_poll(struct tpm_softc * sc,u_int8_t mask,int tmo,void * c)800 tpm_waitfor_poll(struct tpm_softc *sc, u_int8_t mask, int tmo, void *c)
801 {
802 	int rv;
803 
804 	sx_assert(&sc->sc_lock, SA_XLOCKED);
805 	/*
806 	 * Poll until either the requested condition or a time out is
807 	 * met.
808 	 */
809 	while (((sc->sc_stat = tpm_status(sc)) & mask) != mask && tmo--) {
810 		rv = tsleep(c, PRIBIO | PCATCH, "tpm_poll", 1);
811 		if (rv && rv != EWOULDBLOCK) {
812 #ifdef TPM_DEBUG
813 			printf("tpm_waitfor_poll: interrupted %d\n", rv);
814 #endif
815 			return rv;
816 		}
817 	}
818 
819 	return 0;
820 }
821 
822 /* Wait for given status bits using interrupts. */
823 int
tpm_waitfor_int(struct tpm_softc * sc,u_int8_t mask,int tmo,int inttype)824 tpm_waitfor_int(struct tpm_softc *sc, u_int8_t mask, int tmo, int inttype)
825 {
826 	sbintime_t deadline;
827 	int rv;
828 
829 	sx_assert(&sc->sc_lock, SA_XLOCKED);
830 	mtx_lock(&sc->sc_intr_lock);
831 
832 	/* Poll and return when condition is already met. */
833 	sc->sc_stat = tpm_status(sc);
834 	if ((sc->sc_stat & mask) == mask) {
835 		rv = 0;
836 		goto out;
837 	}
838 
839 	/*
840 	 * The handler takes sc_intr_lock before acknowledging and waking us,
841 	 * so an event cannot be lost between the status check and CV wait.
842 	 */
843 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
844 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) |
845 	    inttype);
846 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
847 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) |
848 	    TPM_GLOBAL_INT_ENABLE);
849 
850 	/*
851 	 * Poll once more to remedy the race between previous polling
852 	 * and enabling interrupts on the tpm chip.
853 	 */
854 	sc->sc_stat = tpm_status(sc);
855 	if ((sc->sc_stat & mask) == mask) {
856 		rv = 0;
857 		goto disable;
858 	}
859 
860 	deadline = sbinuptime() + mstosbt(tmo);
861 #ifdef TPM_DEBUG
862 	printf("tpm_waitfor_int: sleeping for %d ms\n", tmo);
863 #endif
864 	do {
865 		rv = cv_timedwait_sig_sbt(&sc->sc_intr_cv,
866 		    &sc->sc_intr_lock, deadline, 0,
867 		    C_ABSOLUTE | C_HARDCLOCK);
868 		sc->sc_stat = tpm_status(sc);
869 		if ((sc->sc_stat & mask) == mask) {
870 			rv = 0;
871 			break;
872 		}
873 	} while (rv == 0);
874 #ifdef TPM_DEBUG
875 	printf("tpm_waitfor_int: woke up with rv %d stat %b\n", rv,
876 	    sc->sc_stat, TPM_STS_BITS);
877 #endif
878 
879 	/* Disable interrupts on tpm chip again. */
880 disable:
881 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
882 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
883 	    ~TPM_GLOBAL_INT_ENABLE);
884 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
885 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
886 	    ~inttype);
887 
888 out:
889 	mtx_unlock(&sc->sc_intr_lock);
890 	return (rv);
891 }
892 
893 /*
894  * Wait on given status bits, uses interrupts where possible, otherwise polls.
895  */
896 int
tpm_waitfor(struct tpm_softc * sc,u_int8_t b0,int tmo,void * c)897 tpm_waitfor(struct tpm_softc *sc, u_int8_t b0, int tmo, void *c)
898 {
899 	u_int8_t b;
900 	int re, to, rv;
901 
902 #ifdef TPM_DEBUG
903 	printf("tpm_waitfor: b0 %b\n", b0, TPM_STS_BITS);
904 #endif
905 	sx_assert(&sc->sc_lock, SA_XLOCKED);
906 
907 	/*
908 	 * If possible, use interrupts, otherwise poll.
909 	 *
910 	 * We use interrupts for TPM_STS_VALID and TPM_STS_DATA_AVAIL (if
911 	 * the tpm chips supports them) as waiting for those can take
912 	 * really long.  The other TPM_STS* are not needed very often
913 	 * so we do not support them.
914 	 */
915 	if (sc->sc_vector != IRQUNK) {
916 		b = b0;
917 
918 		/*
919 		 * Wait for data ready.  This interrupt only occurs
920 		 * when both TPM_STS_VALID and TPM_STS_DATA_AVAIL are asserted.
921 		 * Thus we don't have to bother with TPM_STS_VALID
922 		 * separately and can just return.
923 		 *
924 		 * This only holds for interrupts!  When using polling
925 		 * both flags have to be waited for, see below.
926 		 */
927 		if ((b & TPM_STS_DATA_AVAIL) && (sc->sc_capabilities &
928 		    TPM_INTF_DATA_AVAIL_INT))
929 			return tpm_waitfor_int(sc, b, tmo,
930 			    TPM_DATA_AVAIL_INT);
931 
932 		/* Wait for status valid bit. */
933 		if ((b & TPM_STS_VALID) && (sc->sc_capabilities &
934 		    TPM_INTF_STS_VALID_INT)) {
935 			rv = tpm_waitfor_int(sc, b, tmo, TPM_STS_VALID_INT);
936 			if (rv != 0)
937 				return rv;
938 			else
939 				b = b0 & ~TPM_STS_VALID;
940 		}
941 
942 		/*
943 		 * When all flags are taken care of, return.  Otherwise
944 		 * use polling for eg. TPM_STS_CMD_READY.
945 		 */
946 		if (b == 0)
947 			return 0;
948 	}
949 
950 	re = 3;
951 restart:
952 	/*
953 	 * If requested wait for TPM_STS_VALID before dealing with
954 	 * any other flag.  Eg. when both TPM_STS_DATA_AVAIL and TPM_STS_VALID
955 	 * are requested, wait for the latter first.
956 	 */
957 	b = b0;
958 	if (b0 & TPM_STS_VALID)
959 		b = TPM_STS_VALID;
960 
961 	to = tpm_tmotohz(tmo);
962 again:
963 	if ((rv = tpm_waitfor_poll(sc, b, to, c)) != 0)
964 		return rv;
965 
966 	if ((b & sc->sc_stat) == TPM_STS_VALID) {
967 		/* Now wait for other flags. */
968 		b = b0 & ~TPM_STS_VALID;
969 		to++;
970 		goto again;
971 	}
972 
973 	if ((sc->sc_stat & b) != b) {
974 #ifdef TPM_DEBUG
975 		printf("tpm_waitfor: timeout: stat=%b b=%b\n",
976 		    sc->sc_stat, TPM_STS_BITS, b, TPM_STS_BITS);
977 #endif
978 		if (re-- && (b0 & TPM_STS_VALID)) {
979 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
980 			    TPM_STS_RESP_RETRY);
981 			goto restart;
982 		}
983 		return EIO;
984 	}
985 
986 	return 0;
987 }
988 
989 /* Start transaction. */
990 int
tpm_tis12_start(struct tpm_softc * sc,int flag)991 tpm_tis12_start(struct tpm_softc *sc, int flag)
992 {
993 	int rv;
994 
995 	sx_assert(&sc->sc_lock, SA_XLOCKED);
996 	if (flag == UIO_READ) {
997 		if (!sc->sc_locality || !sc->sc_command_pending) {
998 			tpm_tis12_abort(sc);
999 			return (EIO);
1000 		}
1001 		rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
1002 		    TPM_READ_TMO, sc->sc_read);
1003 		if (rv != 0)
1004 			tpm_tis12_abort(sc);
1005 		return (rv);
1006 	}
1007 
1008 	/* Abort an incomplete command before starting another one. */
1009 	tpm_tis12_abort(sc);
1010 
1011 	/* Own our (0th) locality. */
1012 	if ((rv = tpm_request_locality(sc, 0)) != 0)
1013 		return (rv);
1014 
1015 	sc->sc_stat = tpm_status(sc);
1016 	if (sc->sc_stat & TPM_STS_CMD_READY) {
1017 #ifdef TPM_DEBUG
1018 		printf("tpm_tis12_start: UIO_WRITE status %b\n", sc->sc_stat,
1019 		   TPM_STS_BITS);
1020 #endif
1021 		return 0;
1022 	}
1023 
1024 #ifdef TPM_DEBUG
1025 	printf("tpm_tis12_start: UIO_WRITE readying chip\n");
1026 #endif
1027 
1028 	/* Abort previous and restart. */
1029 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
1030 	if ((rv = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO,
1031 	    sc->sc_write))) {
1032 #ifdef TPM_DEBUG
1033 		printf("tpm_tis12_start: UIO_WRITE readying failed %d\n", rv);
1034 #endif
1035 		tpm_tis12_abort(sc);
1036 		return (rv);
1037 	}
1038 
1039 #ifdef TPM_DEBUG
1040 	printf("tpm_tis12_start: UIO_WRITE readying done\n");
1041 #endif
1042 
1043 	return 0;
1044 }
1045 
1046 int
tpm_tis12_read(struct tpm_softc * sc,void * buf,int len,size_t * count,int flags)1047 tpm_tis12_read(struct tpm_softc *sc, void *buf, int len, size_t *count,
1048     int flags)
1049 {
1050 	u_int8_t *p = buf;
1051 	size_t cnt;
1052 	int rv, n, bcnt;
1053 
1054 #ifdef TPM_DEBUG
1055 	printf("tpm_tis12_read: len %d\n", len);
1056 #endif
1057 	sx_assert(&sc->sc_lock, SA_XLOCKED);
1058 	cnt = 0;
1059 	while (len > 0) {
1060 		if ((rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
1061 		    TPM_READ_TMO, sc->sc_read)))
1062 			return rv;
1063 
1064 		bcnt = tpm_getburst(sc);
1065 		n = MIN(len, bcnt);
1066 #ifdef TPM_DEBUG
1067 		printf("tpm_tis12_read: fetching %d, burst is %d\n", n, bcnt);
1068 #endif
1069 		for (; n--; len--) {
1070 			*p++ = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_DATA);
1071 			cnt++;
1072 		}
1073 
1074 		if ((flags & TPM_PARAM_SIZE) == 0 && cnt >= 6)
1075 			break;
1076 	}
1077 #ifdef TPM_DEBUG
1078 	printf("tpm_tis12_read: read %zd bytes, len %d\n", cnt, len);
1079 #endif
1080 
1081 	if (count)
1082 		*count = cnt;
1083 
1084 	return 0;
1085 }
1086 
1087 int
tpm_tis12_write(struct tpm_softc * sc,void * buf,int len)1088 tpm_tis12_write(struct tpm_softc *sc, void *buf, int len)
1089 {
1090 	u_int8_t *p = buf;
1091 	size_t cnt;
1092 	int rv, r;
1093 
1094 #ifdef TPM_DEBUG
1095 	printf("tpm_tis12_write: sc %p buf %p len %d\n", sc, buf, len);
1096 #endif
1097 
1098 	sx_assert(&sc->sc_lock, SA_XLOCKED);
1099 	if (!sc->sc_locality)
1100 		return (EIO);
1101 
1102 	cnt = 0;
1103 	while (cnt < len - 1) {
1104 		for (r = tpm_getburst(sc); r > 0 && cnt < len - 1; r--) {
1105 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
1106 			cnt++;
1107 		}
1108 		if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
1109 #ifdef TPM_DEBUG
1110 			printf("tpm_tis12_write: failed burst rv %d\n", rv);
1111 #endif
1112 			return rv;
1113 		}
1114 		sc->sc_stat = tpm_status(sc);
1115 		if (!(sc->sc_stat & TPM_STS_DATA_EXPECT)) {
1116 #ifdef TPM_DEBUG
1117 			printf("tpm_tis12_write: failed rv %d stat=%b\n", rv,
1118 			    sc->sc_stat, TPM_STS_BITS);
1119 #endif
1120 			return EIO;
1121 		}
1122 	}
1123 
1124 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
1125 	cnt++;
1126 
1127 	if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
1128 #ifdef TPM_DEBUG
1129 		printf("tpm_tis12_write: failed last byte rv %d\n", rv);
1130 #endif
1131 		return rv;
1132 	}
1133 	if ((sc->sc_stat & TPM_STS_DATA_EXPECT) != 0) {
1134 #ifdef TPM_DEBUG
1135 		printf("tpm_tis12_write: failed rv %d stat=%b\n", rv,
1136 		    sc->sc_stat, TPM_STS_BITS);
1137 #endif
1138 		return EIO;
1139 	}
1140 
1141 #ifdef TPM_DEBUG
1142 	printf("tpm_tis12_write: wrote %d byte\n", cnt);
1143 #endif
1144 
1145 	return 0;
1146 }
1147 
1148 /* Finish transaction. */
1149 int
tpm_tis12_end(struct tpm_softc * sc,int flag,int err)1150 tpm_tis12_end(struct tpm_softc *sc, int flag, int err)
1151 {
1152 	int rv = 0;
1153 
1154 	sx_assert(&sc->sc_lock, SA_XLOCKED);
1155 	if (flag == UIO_READ) {
1156 		if (!sc->sc_locality) {
1157 			tpm_tis12_abort(sc);
1158 			return (err != 0 ? 0 : EIO);
1159 		}
1160 		if (err == 0)
1161 			rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO,
1162 			    sc->sc_read);
1163 
1164 		/* Still more data? */
1165 		if (err == 0 && rv == 0)
1166 			sc->sc_stat = tpm_status(sc);
1167 		if (err == 0 && rv == 0 &&
1168 		    (sc->sc_stat & TPM_STS_DATA_AVAIL) != 0) {
1169 #ifdef TPM_DEBUG
1170 			printf("tpm_tis12_end: read failed stat=%b\n",
1171 			    sc->sc_stat, TPM_STS_BITS);
1172 #endif
1173 			rv = EIO;
1174 		}
1175 		tpm_tis12_abort(sc);
1176 	} else {
1177 		if (!sc->sc_locality) {
1178 			tpm_tis12_abort(sc);
1179 			return (err != 0 ? 0 : EIO);
1180 		}
1181 		/* Hungry for more? */
1182 		sc->sc_stat = tpm_status(sc);
1183 		if (!err && (sc->sc_stat & TPM_STS_DATA_EXPECT)) {
1184 #ifdef TPM_DEBUG
1185 			printf("tpm_tis12_end: write failed stat=%b\n",
1186 			    sc->sc_stat, TPM_STS_BITS);
1187 #endif
1188 			rv = EIO;
1189 		}
1190 
1191 		if (err != 0 || rv != 0)
1192 			tpm_tis12_abort(sc);
1193 		else {
1194 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
1195 			    TPM_STS_GO);
1196 			sc->sc_command_pending = true;
1197 		}
1198 	}
1199 
1200 	return rv;
1201 }
1202 
1203 void
tpm_intr(void * v)1204 tpm_intr(void *v)
1205 {
1206 	struct tpm_softc *sc = v;
1207 	u_int32_t r;
1208 #ifdef TPM_DEBUG
1209 	static int cnt = 0;
1210 #endif
1211 
1212 	mtx_lock(&sc->sc_intr_lock);
1213 	r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS);
1214 #ifdef TPM_DEBUG
1215 	if (r != 0)
1216 		printf("tpm_intr: int=%b (%d)\n", r, TPM_INTERRUPT_ENABLE_BITS,
1217 		    cnt);
1218 	else
1219 		cnt++;
1220 #endif
1221 	if (!(r & (TPM_CMD_READY_INT | TPM_LOCALITY_CHANGE_INT |
1222 	    TPM_STS_VALID_INT | TPM_DATA_AVAIL_INT))) {
1223 		mtx_unlock(&sc->sc_intr_lock);
1224 		return;
1225 	}
1226 
1227 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS, r);
1228 	cv_broadcast(&sc->sc_intr_cv);
1229 	mtx_unlock(&sc->sc_intr_lock);
1230 
1231 	return;
1232 }
1233 
1234 /* Read single byte using legacy interface. */
1235 static inline u_int8_t
tpm_legacy_in(bus_space_tag_t iot,bus_space_handle_t ioh,int reg)1236 tpm_legacy_in(bus_space_tag_t iot, bus_space_handle_t ioh, int reg)
1237 {
1238 	bus_space_write_1(iot, ioh, 0, reg);
1239 	return bus_space_read_1(iot, ioh, 1);
1240 }
1241 
1242 #if 0
1243 /* Write single byte using legacy interface. */
1244 static inline void
1245 tpm_legacy_out(bus_space_tag_t iot, bus_space_handle_t ioh, int reg, u_int8_t v)
1246 {
1247 	bus_space_write_1(iot, ioh, 0, reg);
1248 	bus_space_write_1(iot, ioh, 1, v);
1249 }
1250 #endif
1251 
1252 /* Probe for TPM using legacy interface. */
1253 int
tpm_legacy_probe(bus_space_tag_t iot,bus_addr_t iobase)1254 tpm_legacy_probe(bus_space_tag_t iot, bus_addr_t iobase)
1255 {
1256 	bus_space_handle_t ioh;
1257 	u_int8_t r, v;
1258 	int i, rv = 0;
1259 	char id[8];
1260 
1261 	if (!tpm_enabled || iobase == -1)
1262 		return 0;
1263 
1264 	if (bus_space_map(iot, iobase, 2, 0, &ioh))
1265 		return 0;
1266 
1267 	v = bus_space_read_1(iot, ioh, 0);
1268 	if (v == 0xff) {
1269 		bus_space_unmap(iot, ioh, 2);
1270 		return 0;
1271 	}
1272 	r = bus_space_read_1(iot, ioh, 1);
1273 
1274 	for (i = sizeof(id); i--; )
1275 		id[i] = tpm_legacy_in(iot, ioh, TPM_ID + i);
1276 
1277 #ifdef TPM_DEBUG
1278 	printf("tpm_legacy_probe %.4s %d.%d.%d.%d\n",
1279 	    &id[4], id[0], id[1], id[2], id[3]);
1280 #endif
1281 	/*
1282 	 * The only chips using the legacy interface we are aware of are
1283 	 * by Atmel.  For other chips more signature would have to be added.
1284 	 */
1285 	if (!bcmp(&id[4], "ATML", 4))
1286 		rv = 1;
1287 
1288 	if (!rv) {
1289 		bus_space_write_1(iot, ioh, r, 1);
1290 		bus_space_write_1(iot, ioh, v, 0);
1291 	}
1292 	bus_space_unmap(iot, ioh, 2);
1293 
1294 	return rv;
1295 }
1296 
1297 /* Setup TPM using legacy interface. */
1298 int
tpm_legacy_init(struct tpm_softc * sc,int irq,const char * name)1299 tpm_legacy_init(struct tpm_softc *sc, int irq, const char *name)
1300 {
1301 	char id[8];
1302 	int i;
1303 
1304 	sx_assert(&sc->sc_lock, SA_XLOCKED);
1305 	if ((i = bus_space_map(sc->sc_batm, tpm_enabled, 2, 0, &sc->sc_bahm))) {
1306 		printf(": cannot map tpm registers (%d)\n", i);
1307 		tpm_enabled = 0;
1308 		return 1;
1309 	}
1310 
1311 	for (i = sizeof(id); i--; )
1312 		id[i] = tpm_legacy_in(sc->sc_bt, sc->sc_bh, TPM_ID + i);
1313 
1314 	printf(": %.4s %d.%d @0x%x\n", &id[4], id[0], id[1], tpm_enabled);
1315 	tpm_enabled = 0;
1316 
1317 	return 0;
1318 }
1319 
1320 /* Start transaction. */
1321 int
tpm_legacy_start(struct tpm_softc * sc,int flag)1322 tpm_legacy_start(struct tpm_softc *sc, int flag)
1323 {
1324 	struct timeval tv;
1325 	u_int8_t bits, r;
1326 	int to, rv;
1327 
1328 	sx_assert(&sc->sc_lock, SA_XLOCKED);
1329 	bits = flag == UIO_READ ? TPM_LEGACY_DA : 0;
1330 	tv.tv_sec = TPM_LEGACY_TMO;
1331 	tv.tv_usec = 0;
1332 	to = tvtohz(&tv) / TPM_LEGACY_SLEEP;
1333 	while (((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) &
1334 	    (TPM_LEGACY_BUSY|bits)) != bits && to--) {
1335 		rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_start",
1336 		    TPM_LEGACY_SLEEP);
1337 		if (rv && rv != EWOULDBLOCK)
1338 			return rv;
1339 	}
1340 
1341 	if ((r & (TPM_LEGACY_BUSY|bits)) != bits)
1342 		return EIO;
1343 
1344 	return 0;
1345 }
1346 
1347 int
tpm_legacy_read(struct tpm_softc * sc,void * buf,int len,size_t * count,int flags)1348 tpm_legacy_read(struct tpm_softc *sc, void *buf, int len, size_t *count,
1349     int flags)
1350 {
1351 	u_int8_t *p;
1352 	size_t cnt;
1353 	int to, rv;
1354 
1355 	sx_assert(&sc->sc_lock, SA_XLOCKED);
1356 	cnt = rv = 0;
1357 	for (p = buf; !rv && len > 0; len--) {
1358 		for (to = 1000;
1359 		    !(bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1) &
1360 		    TPM_LEGACY_DA); DELAY(1))
1361 			if (!to--)
1362 				return EIO;
1363 
1364 		DELAY(TPM_LEGACY_DELAY);
1365 		*p++ = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 0);
1366 		cnt++;
1367 	}
1368 
1369 	*count = cnt;
1370 	return 0;
1371 }
1372 
1373 int
tpm_legacy_write(struct tpm_softc * sc,void * buf,int len)1374 tpm_legacy_write(struct tpm_softc *sc, void *buf, int len)
1375 {
1376 	u_int8_t *p;
1377 	int n;
1378 
1379 	sx_assert(&sc->sc_lock, SA_XLOCKED);
1380 	for (p = buf, n = len; n--; DELAY(TPM_LEGACY_DELAY)) {
1381 		if (!n && len != TPM_BUFSIZ) {
1382 			bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1,
1383 			    TPM_LEGACY_LAST);
1384 			DELAY(TPM_LEGACY_DELAY);
1385 		}
1386 		bus_space_write_1(sc->sc_batm, sc->sc_bahm, 0, *p++);
1387 	}
1388 
1389 	return 0;
1390 }
1391 
1392 /* Finish transaction. */
1393 int
tpm_legacy_end(struct tpm_softc * sc,int flag,int rv)1394 tpm_legacy_end(struct tpm_softc *sc, int flag, int rv)
1395 {
1396 	struct timeval tv;
1397 	u_int8_t r;
1398 	int to;
1399 
1400 	sx_assert(&sc->sc_lock, SA_XLOCKED);
1401 	if (rv || flag == UIO_READ)
1402 		bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1, TPM_LEGACY_ABRT);
1403 	else {
1404 		tv.tv_sec = TPM_LEGACY_TMO;
1405 		tv.tv_usec = 0;
1406 		to = tvtohz(&tv) / TPM_LEGACY_SLEEP;
1407 		while(((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) &
1408 		    TPM_LEGACY_BUSY) && to--) {
1409 			rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_end",
1410 			    TPM_LEGACY_SLEEP);
1411 			if (rv && rv != EWOULDBLOCK)
1412 				return rv;
1413 		}
1414 
1415 		if (r & TPM_LEGACY_BUSY)
1416 			return EIO;
1417 
1418 		if (r & TPM_LEGACY_RE)
1419 			return EIO;	/* XXX Retry the loop? */
1420 	}
1421 
1422 	return rv;
1423 }
1424 
1425 int
tpmopen(struct cdev * dev,int flag,int mode,struct thread * td)1426 tpmopen(struct cdev *dev, int flag, int mode, struct thread *td)
1427 {
1428 	struct tpm_softc *sc;
1429 	int error;
1430 
1431 	sc = TPMSOFTC(dev);
1432 	if (sc == NULL)
1433 		return (ENXIO);
1434 
1435 	sx_xlock(&sc->sc_lock);
1436 	if (sc->sc_dying)
1437 		error = ENXIO;
1438 	else if (sc->sc_suspend != 0 || (sc->sc_flags & TPM_OPEN) != 0)
1439 		error = EBUSY;
1440 	else {
1441 		sc->sc_flags |= TPM_OPEN;
1442 		error = 0;
1443 	}
1444 	sx_xunlock(&sc->sc_lock);
1445 
1446 	return (error);
1447 }
1448 
1449 int
tpmclose(struct cdev * dev,int flag,int mode,struct thread * td)1450 tpmclose(struct cdev *dev, int flag, int mode, struct thread *td)
1451 {
1452 	struct tpm_softc *sc;
1453 	int error;
1454 
1455 	sc = TPMSOFTC(dev);
1456 	if (sc == NULL)
1457 		return (ENXIO);
1458 
1459 	sx_xlock(&sc->sc_lock);
1460 	if ((sc->sc_flags & TPM_OPEN) == 0)
1461 		error = EINVAL;
1462 	else {
1463 		if (sc->sc_init == tpm_tis12_init)
1464 			tpm_tis12_abort(sc);
1465 		sc->sc_flags &= ~TPM_OPEN;
1466 		error = 0;
1467 	}
1468 	sx_xunlock(&sc->sc_lock);
1469 
1470 	return (error);
1471 }
1472 
1473 int
tpmread(struct cdev * dev,struct uio * uio,int flags)1474 tpmread(struct cdev *dev, struct uio *uio, int flags)
1475 {
1476 	struct tpm_softc *sc;
1477 	u_int8_t header[TPM_HDRSIZE], *buf;
1478 	size_t cnt, len;
1479 	int end_error, rv;
1480 
1481 	sc = TPMSOFTC(dev);
1482 	if (sc == NULL)
1483 		return (ENXIO);
1484 	buf = NULL;
1485 
1486 	sx_xlock(&sc->sc_lock);
1487 	if (sc->sc_dying) {
1488 		rv = ENXIO;
1489 		goto out;
1490 	}
1491 	if (sc->sc_suspend != 0) {
1492 		rv = EBUSY;
1493 		goto out;
1494 	}
1495 	rv = sc->sc_start(sc, UIO_READ);
1496 	if (rv != 0)
1497 		goto out;
1498 
1499 #ifdef TPM_DEBUG
1500 	printf("tpmread: getting header\n");
1501 #endif
1502 	rv = sc->sc_read(sc, header, sizeof(header), &cnt,
1503 	    TPM_PARAM_SIZE);
1504 	if (rv != 0)
1505 		goto end;
1506 	if (cnt != sizeof(header)) {
1507 		rv = EIO;
1508 		goto end;
1509 	}
1510 
1511 	len = be32dec(header + 2);
1512 #ifdef TPM_DEBUG
1513 	printf("tpmread: len %zu, io count %zd\n", len, uio->uio_resid);
1514 #endif
1515 	if (len < sizeof(header) || len > uio->uio_resid || len > INT_MAX) {
1516 		rv = EIO;
1517 #ifdef TPM_DEBUG
1518 		printf("tpmread: invalid response length %zu\n", len);
1519 #endif
1520 		goto end;
1521 	}
1522 
1523 	/*
1524 	 * Finish the device transaction before touching user memory.  Use a
1525 	 * non-blocking allocation so lifecycle operations are not held up by
1526 	 * memory pressure while waiting for the transaction lock.
1527 	 */
1528 	buf = malloc(len, M_TPM, M_NOWAIT);
1529 	if (buf == NULL) {
1530 		rv = ENOMEM;
1531 		goto end;
1532 	}
1533 	memcpy(buf, header, sizeof(header));
1534 
1535 	if (len > sizeof(header)) {
1536 		rv = sc->sc_read(sc, buf + sizeof(header),
1537 		    (int)(len - sizeof(header)), NULL, TPM_PARAM_SIZE);
1538 		if (rv != 0)
1539 			goto end;
1540 	}
1541 
1542 end:
1543 	end_error = sc->sc_end(sc, UIO_READ, rv);
1544 	if (rv == 0)
1545 		rv = end_error;
1546 out:
1547 	sx_xunlock(&sc->sc_lock);
1548 	if (rv == 0)
1549 		rv = uiomove(buf, (int)len, uio);
1550 	free(buf, M_TPM);
1551 	return (rv);
1552 }
1553 
1554 int
tpmwrite(struct cdev * dev,struct uio * uio,int flags)1555 tpmwrite(struct cdev *dev, struct uio *uio, int flags)
1556 {
1557 	struct tpm_softc *sc;
1558 	u_int8_t buf[TPM_BUFSIZ];
1559 	ssize_t resid;
1560 	int end_error, n, rv;
1561 
1562 	sc = TPMSOFTC(dev);
1563 	if (sc == NULL)
1564 		return (ENXIO);
1565 
1566 	resid = uio->uio_resid;
1567 	n = MIN(sizeof(buf), resid);
1568 	rv = uiomove(buf, n, uio);
1569 	if (rv != 0)
1570 		return (rv);
1571 
1572 	sx_xlock(&sc->sc_lock);
1573 	if (sc->sc_dying) {
1574 		rv = ENXIO;
1575 		goto out;
1576 	}
1577 	if (sc->sc_suspend != 0) {
1578 		rv = EBUSY;
1579 		goto out;
1580 	}
1581 
1582 #ifdef TPM_DEBUG
1583 	printf("tpmwrite: io count %d\n", n);
1584 #endif
1585 
1586 	rv = sc->sc_start(sc, UIO_WRITE);
1587 	if (rv != 0)
1588 		goto out;
1589 
1590 	rv = sc->sc_write(sc, buf, n);
1591 	end_error = sc->sc_end(sc, UIO_WRITE, rv);
1592 	if (rv == 0)
1593 		rv = end_error;
1594 
1595 out:
1596 	sx_xunlock(&sc->sc_lock);
1597 	if (rv != 0)
1598 		uio->uio_resid = resid;
1599 	return (rv);
1600 }
1601 
1602 int
tpmioctl(struct cdev * dev,u_long cmd,caddr_t data,int flags,struct thread * td)1603 tpmioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags,
1604     struct thread *td)
1605 {
1606 	return ENOTTY;
1607 }
1608