1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2014 Intel Corporation
4 *
5 * Authors:
6 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
7 *
8 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9 *
10 * This device driver implements the TPM interface as defined in
11 * the TCG CRB 2.0 TPM specification.
12 */
13
14 #include <linux/acpi.h>
15 #include <linux/highmem.h>
16 #include <linux/rculist.h>
17 #include <linux/module.h>
18 #include <linux/pm_runtime.h>
19 #ifdef CONFIG_ARM64
20 #include <linux/arm-smccc.h>
21 #endif
22 #include "tpm_crb_ffa.h"
23 #include "tpm.h"
24
25 #define ACPI_SIG_TPM2 "TPM2"
26 #define TPM_CRB_MAX_RESOURCES 3
27
28 static const guid_t crb_acpi_start_guid =
29 GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714,
30 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4);
31
32 enum crb_defaults {
33 CRB_ACPI_START_REVISION_ID = 1,
34 CRB_ACPI_START_INDEX = 1,
35 };
36
37 enum crb_loc_ctrl {
38 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0),
39 CRB_LOC_CTRL_RELINQUISH = BIT(1),
40 };
41
42 enum crb_loc_state {
43 CRB_LOC_STATE_LOC_ASSIGNED = BIT(1),
44 CRB_LOC_STATE_TPM_REG_VALID_STS = BIT(7),
45 };
46
47 enum crb_ctrl_req {
48 CRB_CTRL_REQ_CMD_READY = BIT(0),
49 CRB_CTRL_REQ_GO_IDLE = BIT(1),
50 };
51
52 enum crb_ctrl_sts {
53 CRB_CTRL_STS_ERROR = BIT(0),
54 CRB_CTRL_STS_TPM_IDLE = BIT(1),
55 };
56
57 enum crb_start {
58 CRB_START_INVOKE = BIT(0),
59 };
60
61 enum crb_cancel {
62 CRB_CANCEL_INVOKE = BIT(0),
63 };
64
65 struct crb_regs_head {
66 u32 loc_state;
67 u32 reserved1;
68 u32 loc_ctrl;
69 u32 loc_sts;
70 u8 reserved2[32];
71 u64 intf_id;
72 u64 ctrl_ext;
73 } __packed;
74
75 struct crb_regs_tail {
76 u32 ctrl_req;
77 u32 ctrl_sts;
78 u32 ctrl_cancel;
79 u32 ctrl_start;
80 u32 ctrl_int_enable;
81 u32 ctrl_int_sts;
82 u32 ctrl_cmd_size;
83 u32 ctrl_cmd_pa_low;
84 u32 ctrl_cmd_pa_high;
85 u32 ctrl_rsp_size;
86 u64 ctrl_rsp_pa;
87 } __packed;
88
89 enum crb_status {
90 CRB_DRV_STS_COMPLETE = BIT(0),
91 };
92
93 struct crb_priv {
94 u32 sm;
95 const char *hid;
96 struct crb_regs_head __iomem *regs_h;
97 struct crb_regs_tail __iomem *regs_t;
98 u8 __iomem *cmd;
99 u8 __iomem *rsp;
100 u32 cmd_size;
101 u32 smc_func_id;
102 u32 __iomem *pluton_start_addr;
103 u32 __iomem *pluton_reply_addr;
104 u8 ffa_flags;
105 u8 ffa_attributes;
106 };
107
108 struct tpm2_crb_smc {
109 u32 interrupt;
110 u8 interrupt_flags;
111 u8 op_flags;
112 u16 reserved2;
113 u32 smc_func_id;
114 };
115
116 /* CRB over FFA start method parameters in TCG2 ACPI table */
117 struct tpm2_crb_ffa {
118 u8 flags;
119 u8 attributes;
120 u16 partition_id;
121 u8 reserved[8];
122 };
123
124 struct tpm2_crb_pluton {
125 u64 start_addr;
126 u64 reply_addr;
127 };
128
129 /*
130 * Returns true if the start method supports idle.
131 */
tpm_crb_has_idle(u32 start_method)132 static inline bool tpm_crb_has_idle(u32 start_method)
133 {
134 return !(start_method == ACPI_TPM2_START_METHOD ||
135 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD ||
136 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC);
137 }
138
crb_wait_for_reg_32(u32 __iomem * reg,u32 mask,u32 value,unsigned long timeout)139 static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
140 unsigned long timeout)
141 {
142 ktime_t start;
143 ktime_t stop;
144
145 start = ktime_get();
146 stop = ktime_add(start, ms_to_ktime(timeout));
147
148 do {
149 if ((ioread32(reg) & mask) == value)
150 return true;
151
152 usleep_range(50, 100);
153 } while (ktime_before(ktime_get(), stop));
154
155 return ((ioread32(reg) & mask) == value);
156 }
157
crb_try_pluton_doorbell(struct crb_priv * priv,bool wait_for_complete)158 static int crb_try_pluton_doorbell(struct crb_priv *priv, bool wait_for_complete)
159 {
160 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON)
161 return 0;
162
163 if (!crb_wait_for_reg_32(priv->pluton_reply_addr, ~0, 1, TPM2_TIMEOUT_C))
164 return -ETIME;
165
166 iowrite32(1, priv->pluton_start_addr);
167 if (wait_for_complete == false)
168 return 0;
169
170 if (!crb_wait_for_reg_32(priv->pluton_start_addr,
171 0xffffffff, 0, 200))
172 return -ETIME;
173
174 return 0;
175 }
176
177 /**
178 * __crb_go_idle - request tpm crb device to go the idle state
179 *
180 * @dev: crb device
181 * @priv: crb private data
182 * @loc: locality
183 *
184 * Write CRB_CTRL_REQ_GO_IDLE to TPM_CRB_CTRL_REQ
185 * The device should respond within TIMEOUT_C by clearing the bit.
186 * Anyhow, we do not wait here as a consequent CMD_READY request
187 * will be handled correctly even if idle was not completed.
188 *
189 * The function does nothing for devices with ACPI-start method
190 * or SMC-start method.
191 *
192 * Return: 0 always
193 */
__crb_go_idle(struct device * dev,struct crb_priv * priv,int loc)194 static int __crb_go_idle(struct device *dev, struct crb_priv *priv, int loc)
195 {
196 int rc;
197
198 if (!tpm_crb_has_idle(priv->sm))
199 return 0;
200
201 iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req);
202
203 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
204 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc);
205 if (rc)
206 return rc;
207 }
208
209 rc = crb_try_pluton_doorbell(priv, true);
210 if (rc)
211 return rc;
212
213 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
214 CRB_CTRL_REQ_GO_IDLE/* mask */,
215 0, /* value */
216 TPM2_TIMEOUT_C)) {
217 dev_warn(dev, "goIdle timed out\n");
218 return -ETIME;
219 }
220
221 return 0;
222 }
223
crb_go_idle(struct tpm_chip * chip)224 static int crb_go_idle(struct tpm_chip *chip)
225 {
226 struct device *dev = &chip->dev;
227 struct crb_priv *priv = dev_get_drvdata(dev);
228
229 return __crb_go_idle(dev, priv, chip->locality);
230 }
231
232 /**
233 * __crb_cmd_ready - request tpm crb device to enter ready state
234 *
235 * @dev: crb device
236 * @priv: crb private data
237 * @loc: locality
238 *
239 * Write CRB_CTRL_REQ_CMD_READY to TPM_CRB_CTRL_REQ
240 * and poll till the device acknowledge it by clearing the bit.
241 * The device should respond within TIMEOUT_C.
242 *
243 * The function does nothing for devices with ACPI-start method
244 * or SMC-start method.
245 *
246 * Return: 0 on success -ETIME on timeout;
247 */
__crb_cmd_ready(struct device * dev,struct crb_priv * priv,int loc)248 static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv, int loc)
249 {
250 int rc;
251
252 if (!tpm_crb_has_idle(priv->sm))
253 return 0;
254
255 iowrite32(CRB_CTRL_REQ_CMD_READY, &priv->regs_t->ctrl_req);
256
257 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
258 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc);
259 if (rc)
260 return rc;
261 }
262
263 rc = crb_try_pluton_doorbell(priv, true);
264 if (rc)
265 return rc;
266
267 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
268 CRB_CTRL_REQ_CMD_READY /* mask */,
269 0, /* value */
270 TPM2_TIMEOUT_C)) {
271 dev_warn(dev, "cmdReady timed out\n");
272 return -ETIME;
273 }
274
275 return 0;
276 }
277
crb_cmd_ready(struct tpm_chip * chip)278 static int crb_cmd_ready(struct tpm_chip *chip)
279 {
280 struct device *dev = &chip->dev;
281 struct crb_priv *priv = dev_get_drvdata(dev);
282
283 return __crb_cmd_ready(dev, priv, chip->locality);
284 }
285
__crb_request_locality(struct device * dev,struct crb_priv * priv,int loc)286 static int __crb_request_locality(struct device *dev,
287 struct crb_priv *priv, int loc)
288 {
289 u32 value = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS;
290 int rc;
291
292 if (!priv->regs_h)
293 return 0;
294
295 iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl);
296
297 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
298 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc);
299 if (rc)
300 return rc;
301 }
302
303 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value,
304 TPM2_TIMEOUT_C)) {
305 dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
306 return -ETIME;
307 }
308
309 return 0;
310 }
311
crb_request_locality(struct tpm_chip * chip,int loc)312 static int crb_request_locality(struct tpm_chip *chip, int loc)
313 {
314 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
315
316 return __crb_request_locality(&chip->dev, priv, loc);
317 }
318
__crb_relinquish_locality(struct device * dev,struct crb_priv * priv,int loc)319 static int __crb_relinquish_locality(struct device *dev,
320 struct crb_priv *priv, int loc)
321 {
322 u32 mask = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS;
323 u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS;
324 int rc;
325
326 if (!priv->regs_h)
327 return 0;
328
329 iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
330
331 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
332 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc);
333 if (rc)
334 return rc;
335 }
336
337 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value,
338 TPM2_TIMEOUT_C)) {
339 dev_warn(dev, "TPM_LOC_STATE_x.Relinquish timed out\n");
340 return -ETIME;
341 }
342
343 return 0;
344 }
345
crb_relinquish_locality(struct tpm_chip * chip,int loc)346 static int crb_relinquish_locality(struct tpm_chip *chip, int loc)
347 {
348 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
349
350 return __crb_relinquish_locality(&chip->dev, priv, loc);
351 }
352
crb_status(struct tpm_chip * chip)353 static u8 crb_status(struct tpm_chip *chip)
354 {
355 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
356 u8 sts = 0;
357
358 if ((ioread32(&priv->regs_t->ctrl_start) & CRB_START_INVOKE) !=
359 CRB_START_INVOKE)
360 sts |= CRB_DRV_STS_COMPLETE;
361
362 return sts;
363 }
364
crb_recv(struct tpm_chip * chip,u8 * buf,size_t count)365 static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
366 {
367 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
368 unsigned int expected;
369
370 /* A sanity check that the upper layer wants to get at least the header
371 * as that is the minimum size for any TPM response.
372 */
373 if (count < TPM_HEADER_SIZE)
374 return -EIO;
375
376 /* If this bit is set, according to the spec, the TPM is in
377 * unrecoverable condition.
378 */
379 if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR)
380 return -EIO;
381
382 /* Read the first 8 bytes in order to get the length of the response.
383 * We read exactly a quad word in order to make sure that the remaining
384 * reads will be aligned.
385 */
386 memcpy_fromio(buf, priv->rsp, 8);
387
388 expected = be32_to_cpup((__be32 *)&buf[2]);
389 if (expected > count || expected < TPM_HEADER_SIZE)
390 return -EIO;
391
392 memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8);
393
394 return expected;
395 }
396
crb_do_acpi_start(struct tpm_chip * chip)397 static int crb_do_acpi_start(struct tpm_chip *chip)
398 {
399 union acpi_object *obj;
400 int rc;
401
402 obj = acpi_evaluate_dsm(chip->acpi_dev_handle,
403 &crb_acpi_start_guid,
404 CRB_ACPI_START_REVISION_ID,
405 CRB_ACPI_START_INDEX,
406 NULL);
407 if (!obj)
408 return -ENXIO;
409 rc = obj->integer.value == 0 ? 0 : -ENXIO;
410 ACPI_FREE(obj);
411 return rc;
412 }
413
414 #ifdef CONFIG_ARM64
415 /*
416 * This is a TPM Command Response Buffer start method that invokes a
417 * Secure Monitor Call to request the firmware to execute or cancel
418 * a TPM 2.0 command.
419 */
tpm_crb_smc_start(struct device * dev,unsigned long func_id)420 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id)
421 {
422 struct arm_smccc_res res;
423
424 arm_smccc_smc(func_id, 0, 0, 0, 0, 0, 0, 0, &res);
425 if (res.a0 != 0) {
426 dev_err(dev,
427 FW_BUG "tpm_crb_smc_start() returns res.a0 = 0x%lx\n",
428 res.a0);
429 return -EIO;
430 }
431
432 return 0;
433 }
434 #else
tpm_crb_smc_start(struct device * dev,unsigned long func_id)435 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id)
436 {
437 dev_err(dev, FW_BUG "tpm_crb: incorrect start method\n");
438 return -EINVAL;
439 }
440 #endif
441
crb_send(struct tpm_chip * chip,u8 * buf,size_t bufsiz,size_t len)442 static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len)
443 {
444 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
445 int rc = 0;
446
447 /* Zero the cancel register so that the next command will not get
448 * canceled.
449 */
450 iowrite32(0, &priv->regs_t->ctrl_cancel);
451
452 if (len > priv->cmd_size) {
453 dev_err(&chip->dev, "invalid command count value %zd %d\n",
454 len, priv->cmd_size);
455 return -E2BIG;
456 }
457
458 /* Seems to be necessary for every command */
459 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON)
460 __crb_cmd_ready(&chip->dev, priv, chip->locality);
461
462 memcpy_toio(priv->cmd, buf, len);
463
464 /* Make sure that cmd is populated before issuing start. */
465 wmb();
466
467 /* The reason for the extra quirk is that the PTT in 4th Gen Core CPUs
468 * report only ACPI start but in practice seems to require both
469 * CRB start, hence invoking CRB start method if hid == MSFT0101.
470 */
471 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER ||
472 priv->sm == ACPI_TPM2_MEMORY_MAPPED ||
473 !strcmp(priv->hid, "MSFT0101"))
474 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start);
475
476 if (priv->sm == ACPI_TPM2_START_METHOD ||
477 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD)
478 rc = crb_do_acpi_start(chip);
479
480 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
481 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start);
482 rc = tpm_crb_smc_start(&chip->dev, priv->smc_func_id);
483 }
484
485 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
486 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start);
487 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality);
488 }
489
490 if (rc)
491 return rc;
492
493 return crb_try_pluton_doorbell(priv, false);
494 }
495
crb_cancel(struct tpm_chip * chip)496 static void crb_cancel(struct tpm_chip *chip)
497 {
498 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
499 int rc;
500
501 iowrite32(CRB_CANCEL_INVOKE, &priv->regs_t->ctrl_cancel);
502
503 if ((priv->sm == ACPI_TPM2_START_METHOD ||
504 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) &&
505 crb_do_acpi_start(chip))
506 dev_err(&chip->dev, "ACPI Start failed\n");
507
508 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
509 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality);
510 if (rc)
511 dev_err(&chip->dev, "FF-A Start failed\n");
512 }
513 }
514
crb_req_canceled(struct tpm_chip * chip,u8 status)515 static bool crb_req_canceled(struct tpm_chip *chip, u8 status)
516 {
517 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
518 u32 cancel = ioread32(&priv->regs_t->ctrl_cancel);
519
520 return (cancel & CRB_CANCEL_INVOKE) == CRB_CANCEL_INVOKE;
521 }
522
523 static const struct tpm_class_ops tpm_crb = {
524 .flags = TPM_OPS_AUTO_STARTUP,
525 .status = crb_status,
526 .recv = crb_recv,
527 .send = crb_send,
528 .cancel = crb_cancel,
529 .req_canceled = crb_req_canceled,
530 .go_idle = crb_go_idle,
531 .cmd_ready = crb_cmd_ready,
532 .request_locality = crb_request_locality,
533 .relinquish_locality = crb_relinquish_locality,
534 .req_complete_mask = CRB_DRV_STS_COMPLETE,
535 .req_complete_val = CRB_DRV_STS_COMPLETE,
536 };
537
crb_check_resource(struct acpi_resource * ares,void * data)538 static int crb_check_resource(struct acpi_resource *ares, void *data)
539 {
540 struct resource *iores_array = data;
541 struct resource_win win;
542 struct resource *res = &(win.res);
543 int i;
544
545 if (acpi_dev_resource_memory(ares, res) ||
546 acpi_dev_resource_address_space(ares, &win)) {
547 for (i = 0; i < TPM_CRB_MAX_RESOURCES + 1; ++i) {
548 if (resource_type(iores_array + i) != IORESOURCE_MEM) {
549 iores_array[i] = *res;
550 iores_array[i].name = NULL;
551 break;
552 }
553 }
554 }
555
556 return 1;
557 }
558
crb_map_res(struct device * dev,struct resource * iores,void __iomem ** iobase_ptr,u64 start,u32 size)559 static void __iomem *crb_map_res(struct device *dev, struct resource *iores,
560 void __iomem **iobase_ptr, u64 start, u32 size)
561 {
562 struct resource new_res = {
563 .start = start,
564 .end = start + size - 1,
565 .flags = IORESOURCE_MEM,
566 };
567
568 /* Detect a 64 bit address on a 32 bit system */
569 if (start != new_res.start)
570 return IOMEM_ERR_PTR(-EINVAL);
571
572 if (!iores)
573 return devm_ioremap_resource(dev, &new_res);
574
575 if (!*iobase_ptr) {
576 *iobase_ptr = devm_ioremap_resource(dev, iores);
577 if (IS_ERR(*iobase_ptr))
578 return *iobase_ptr;
579 }
580
581 return *iobase_ptr + (new_res.start - iores->start);
582 }
583
584 /*
585 * Work around broken BIOSs that return inconsistent values from the ACPI
586 * region vs the registers. Trust the ACPI region. Such broken systems
587 * probably cannot send large TPM commands since the buffer will be truncated.
588 */
crb_fixup_cmd_size(struct device * dev,struct resource * io_res,u64 start,u64 size)589 static u64 crb_fixup_cmd_size(struct device *dev, struct resource *io_res,
590 u64 start, u64 size)
591 {
592 if (io_res->start > start || io_res->end < start)
593 return size;
594
595 if (start + size - 1 <= io_res->end)
596 return size;
597
598 dev_err(dev,
599 FW_BUG "ACPI region does not cover the entire command/response buffer. %pr vs %llx %llx\n",
600 io_res, start, size);
601
602 return io_res->end - start + 1;
603 }
604
crb_map_io(struct acpi_device * device,struct crb_priv * priv,struct acpi_table_tpm2 * buf)605 static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
606 struct acpi_table_tpm2 *buf)
607 {
608 struct list_head acpi_resource_list;
609 struct resource iores_array[TPM_CRB_MAX_RESOURCES + 1] = { {0} };
610 void __iomem *iobase_array[TPM_CRB_MAX_RESOURCES] = {NULL};
611 struct device *dev = &device->dev;
612 struct resource *iores;
613 void __iomem **iobase_ptr;
614 int i;
615 u32 pa_high, pa_low;
616 u64 cmd_pa;
617 u32 cmd_size;
618 __le64 __rsp_pa;
619 u64 rsp_pa;
620 u32 rsp_size;
621 int ret;
622
623 /*
624 * Pluton sometimes does not define ACPI memory regions.
625 * Mapping is then done in crb_map_pluton
626 */
627 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
628 INIT_LIST_HEAD(&acpi_resource_list);
629 ret = acpi_dev_get_resources(device, &acpi_resource_list,
630 crb_check_resource, iores_array);
631 if (ret < 0)
632 return ret;
633 acpi_dev_free_resource_list(&acpi_resource_list);
634
635 if (resource_type(iores_array) != IORESOURCE_MEM) {
636 dev_err(dev, FW_BUG "TPM2 ACPI table does not define a memory resource\n");
637 return -EINVAL;
638 } else if (resource_type(iores_array + TPM_CRB_MAX_RESOURCES) ==
639 IORESOURCE_MEM) {
640 dev_warn(dev, "TPM2 ACPI table defines too many memory resources\n");
641 memset(iores_array + TPM_CRB_MAX_RESOURCES,
642 0, sizeof(*iores_array));
643 iores_array[TPM_CRB_MAX_RESOURCES].flags = 0;
644 }
645 }
646
647 iores = NULL;
648 iobase_ptr = NULL;
649 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) {
650 if (buf->control_address >= iores_array[i].start &&
651 buf->control_address + sizeof(struct crb_regs_tail) - 1 <=
652 iores_array[i].end) {
653 iores = iores_array + i;
654 iobase_ptr = iobase_array + i;
655 break;
656 }
657 }
658
659 priv->regs_t = crb_map_res(dev, iores, iobase_ptr, buf->control_address,
660 sizeof(struct crb_regs_tail));
661
662 if (IS_ERR(priv->regs_t))
663 return PTR_ERR(priv->regs_t);
664
665 /* The ACPI IO region starts at the head area and continues to include
666 * the control area, as one nice sane region except for some older
667 * stuff that puts the control area outside the ACPI IO region.
668 */
669 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER ||
670 priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA ||
671 priv->sm == ACPI_TPM2_MEMORY_MAPPED) {
672 if (iores &&
673 buf->control_address == iores->start +
674 sizeof(*priv->regs_h))
675 priv->regs_h = *iobase_ptr;
676 else
677 dev_warn(dev, FW_BUG "Bad ACPI memory layout");
678 }
679
680 ret = __crb_request_locality(dev, priv, 0);
681 if (ret)
682 return ret;
683
684 /*
685 * PTT HW bug w/a: wake up the device to access
686 * possibly not retained registers.
687 */
688 ret = __crb_cmd_ready(dev, priv, 0);
689 if (ret)
690 goto out_relinquish_locality;
691
692 pa_high = ioread32(&priv->regs_t->ctrl_cmd_pa_high);
693 pa_low = ioread32(&priv->regs_t->ctrl_cmd_pa_low);
694 cmd_pa = ((u64)pa_high << 32) | pa_low;
695 cmd_size = ioread32(&priv->regs_t->ctrl_cmd_size);
696
697 iores = NULL;
698 iobase_ptr = NULL;
699 for (i = 0; iores_array[i].end; ++i) {
700 if (cmd_pa >= iores_array[i].start &&
701 cmd_pa <= iores_array[i].end) {
702 iores = iores_array + i;
703 iobase_ptr = iobase_array + i;
704 break;
705 }
706 }
707
708 if (iores)
709 cmd_size = crb_fixup_cmd_size(dev, iores, cmd_pa, cmd_size);
710
711 dev_dbg(dev, "cmd_hi = %X cmd_low = %X cmd_size %X\n",
712 pa_high, pa_low, cmd_size);
713
714 priv->cmd = crb_map_res(dev, iores, iobase_ptr, cmd_pa, cmd_size);
715 if (IS_ERR(priv->cmd)) {
716 ret = PTR_ERR(priv->cmd);
717 goto out;
718 }
719
720 memcpy_fromio(&__rsp_pa, &priv->regs_t->ctrl_rsp_pa, 8);
721 rsp_pa = le64_to_cpu(__rsp_pa);
722 rsp_size = ioread32(&priv->regs_t->ctrl_rsp_size);
723
724 iores = NULL;
725 iobase_ptr = NULL;
726 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) {
727 if (rsp_pa >= iores_array[i].start &&
728 rsp_pa <= iores_array[i].end) {
729 iores = iores_array + i;
730 iobase_ptr = iobase_array + i;
731 break;
732 }
733 }
734
735 if (iores)
736 rsp_size = crb_fixup_cmd_size(dev, iores, rsp_pa, rsp_size);
737
738 if (cmd_pa != rsp_pa) {
739 priv->rsp = crb_map_res(dev, iores, iobase_ptr,
740 rsp_pa, rsp_size);
741 ret = PTR_ERR_OR_ZERO(priv->rsp);
742 goto out;
743 }
744
745 /* According to the PTP specification, overlapping command and response
746 * buffer sizes must be identical.
747 */
748 if (cmd_size != rsp_size) {
749 dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
750 ret = -EINVAL;
751 goto out;
752 }
753
754 priv->rsp = priv->cmd;
755
756 out:
757 if (!ret)
758 priv->cmd_size = cmd_size;
759
760 __crb_go_idle(dev, priv, 0);
761
762 out_relinquish_locality:
763
764 __crb_relinquish_locality(dev, priv, 0);
765
766 return ret;
767 }
768
crb_map_pluton(struct device * dev,struct crb_priv * priv,struct acpi_table_tpm2 * buf,struct tpm2_crb_pluton * crb_pluton)769 static int crb_map_pluton(struct device *dev, struct crb_priv *priv,
770 struct acpi_table_tpm2 *buf, struct tpm2_crb_pluton *crb_pluton)
771 {
772 priv->pluton_start_addr = crb_map_res(dev, NULL, NULL,
773 crb_pluton->start_addr, 4);
774 if (IS_ERR(priv->pluton_start_addr))
775 return PTR_ERR(priv->pluton_start_addr);
776
777 priv->pluton_reply_addr = crb_map_res(dev, NULL, NULL,
778 crb_pluton->reply_addr, 4);
779 if (IS_ERR(priv->pluton_reply_addr))
780 return PTR_ERR(priv->pluton_reply_addr);
781
782 return 0;
783 }
784
crb_acpi_add(struct acpi_device * device)785 static int crb_acpi_add(struct acpi_device *device)
786 {
787 struct acpi_table_tpm2 *buf;
788 struct crb_priv *priv;
789 struct tpm_chip *chip;
790 struct device *dev = &device->dev;
791 struct tpm2_crb_smc *crb_smc;
792 struct tpm2_crb_ffa *crb_ffa;
793 struct tpm2_crb_pluton *crb_pluton;
794 acpi_status status;
795 u32 sm;
796 int rc;
797
798 status = acpi_get_table(ACPI_SIG_TPM2, 1,
799 (struct acpi_table_header **) &buf);
800 if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) {
801 dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n");
802 return -EINVAL;
803 }
804
805 /* Should the FIFO driver handle this? */
806 sm = buf->start_method;
807 if (sm == ACPI_TPM2_MEMORY_MAPPED) {
808 rc = -ENODEV;
809 goto out;
810 }
811
812 priv = devm_kzalloc(dev, sizeof(struct crb_priv), GFP_KERNEL);
813 if (!priv) {
814 rc = -ENOMEM;
815 goto out;
816 }
817
818 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
819 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_smc))) {
820 dev_err(dev,
821 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
822 buf->header.length,
823 ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC);
824 rc = -EINVAL;
825 goto out;
826 }
827 crb_smc = ACPI_ADD_PTR(struct tpm2_crb_smc, buf, sizeof(*buf));
828 priv->smc_func_id = crb_smc->smc_func_id;
829 }
830
831 if (sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
832 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_ffa))) {
833 dev_err(dev,
834 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
835 buf->header.length,
836 ACPI_TPM2_CRB_WITH_ARM_FFA);
837 rc = -EINVAL;
838 goto out;
839 }
840 crb_ffa = ACPI_ADD_PTR(struct tpm2_crb_ffa, buf, sizeof(*buf));
841 priv->ffa_flags = crb_ffa->flags;
842 priv->ffa_attributes = crb_ffa->attributes;
843 rc = tpm_crb_ffa_init();
844 if (rc) {
845 /* If FF-A driver is not available yet, request probe retry */
846 if (rc == -ENOENT)
847 rc = -EPROBE_DEFER;
848 goto out;
849 }
850 }
851
852 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
853 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_pluton))) {
854 dev_err(dev,
855 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
856 buf->header.length,
857 ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON);
858 rc = -EINVAL;
859 goto out;
860 }
861 crb_pluton = ACPI_ADD_PTR(struct tpm2_crb_pluton, buf, sizeof(*buf));
862 rc = crb_map_pluton(dev, priv, buf, crb_pluton);
863 if (rc)
864 goto out;
865 }
866
867 priv->sm = sm;
868 priv->hid = acpi_device_hid(device);
869
870 rc = crb_map_io(device, priv, buf);
871 if (rc)
872 goto out;
873
874 chip = tpmm_chip_alloc(dev, &tpm_crb);
875 if (IS_ERR(chip)) {
876 rc = PTR_ERR(chip);
877 goto out;
878 }
879
880 dev_set_drvdata(&chip->dev, priv);
881 chip->acpi_dev_handle = device->handle;
882 chip->flags = TPM_CHIP_FLAG_TPM2;
883
884 rc = tpm_chip_bootstrap(chip);
885 if (rc)
886 goto out;
887
888 #ifdef CONFIG_X86
889 /* A quirk for https://www.amd.com/en/support/kb/faq/pa-410 */
890 if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
891 priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
892 dev_info(dev, "Disabling hwrng\n");
893 chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED;
894 }
895 #endif /* CONFIG_X86 */
896
897 rc = tpm_chip_register(chip);
898
899 out:
900 acpi_put_table((struct acpi_table_header *)buf);
901 return rc;
902 }
903
crb_acpi_remove(struct acpi_device * device)904 static void crb_acpi_remove(struct acpi_device *device)
905 {
906 struct device *dev = &device->dev;
907 struct tpm_chip *chip = dev_get_drvdata(dev);
908
909 tpm_chip_unregister(chip);
910 }
911
912 static const struct dev_pm_ops crb_pm = {
913 SET_SYSTEM_SLEEP_PM_OPS(tpm_pm_suspend, tpm_pm_resume)
914 };
915
916 static const struct acpi_device_id crb_device_ids[] = {
917 {"MSFT0101", 0},
918 {"", 0},
919 };
920 MODULE_DEVICE_TABLE(acpi, crb_device_ids);
921
922 static struct acpi_driver crb_acpi_driver = {
923 .name = "tpm_crb",
924 .ids = crb_device_ids,
925 .ops = {
926 .add = crb_acpi_add,
927 .remove = crb_acpi_remove,
928 },
929 .drv = {
930 .pm = &crb_pm,
931 },
932 };
933
934 module_acpi_driver(crb_acpi_driver);
935 MODULE_AUTHOR("Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>");
936 MODULE_DESCRIPTION("TPM2 Driver");
937 MODULE_VERSION("0.1");
938 MODULE_LICENSE("GPL");
939