1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2014 Intel Corporation
4 *
5 * Authors:
6 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
7 *
8 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9 *
10 * This device driver implements the TPM interface as defined in
11 * the TCG CRB 2.0 TPM specification.
12 */
13
14 #include <linux/acpi.h>
15 #include <linux/highmem.h>
16 #include <linux/rculist.h>
17 #include <linux/module.h>
18 #include <linux/platform_device.h>
19 #include <linux/pm_runtime.h>
20 #ifdef CONFIG_ARM64
21 #include <linux/arm-smccc.h>
22 #endif
23 #include "tpm_crb_ffa.h"
24 #include "tpm.h"
25
26 #define ACPI_SIG_TPM2 "TPM2"
27 #define TPM_CRB_MAX_RESOURCES 3
28
29 static const guid_t crb_acpi_start_guid =
30 GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714,
31 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4);
32
33 enum crb_defaults {
34 CRB_ACPI_START_REVISION_ID = 1,
35 CRB_ACPI_START_INDEX = 1,
36 };
37
38 enum crb_loc_ctrl {
39 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0),
40 CRB_LOC_CTRL_RELINQUISH = BIT(1),
41 };
42
43 enum crb_loc_state {
44 CRB_LOC_STATE_LOC_ASSIGNED = BIT(1),
45 CRB_LOC_STATE_TPM_REG_VALID_STS = BIT(7),
46 };
47
48 enum crb_ctrl_req {
49 CRB_CTRL_REQ_CMD_READY = BIT(0),
50 CRB_CTRL_REQ_GO_IDLE = BIT(1),
51 };
52
53 enum crb_ctrl_sts {
54 CRB_CTRL_STS_ERROR = BIT(0),
55 CRB_CTRL_STS_TPM_IDLE = BIT(1),
56 };
57
58 enum crb_start {
59 CRB_START_INVOKE = BIT(0),
60 };
61
62 enum crb_cancel {
63 CRB_CANCEL_INVOKE = BIT(0),
64 };
65
66 struct crb_regs_head {
67 u32 loc_state;
68 u32 reserved1;
69 u32 loc_ctrl;
70 u32 loc_sts;
71 u8 reserved2[32];
72 u64 intf_id;
73 u64 ctrl_ext;
74 } __packed;
75
76 struct crb_regs_tail {
77 u32 ctrl_req;
78 u32 ctrl_sts;
79 u32 ctrl_cancel;
80 u32 ctrl_start;
81 u32 ctrl_int_enable;
82 u32 ctrl_int_sts;
83 u32 ctrl_cmd_size;
84 u32 ctrl_cmd_pa_low;
85 u32 ctrl_cmd_pa_high;
86 u32 ctrl_rsp_size;
87 u64 ctrl_rsp_pa;
88 } __packed;
89
90 enum crb_status {
91 CRB_DRV_STS_COMPLETE = BIT(0),
92 };
93
94 struct crb_priv {
95 u32 sm;
96 const char *hid;
97 struct crb_regs_head __iomem *regs_h;
98 struct crb_regs_tail __iomem *regs_t;
99 u8 __iomem *cmd;
100 u8 __iomem *rsp;
101 u32 cmd_size;
102 u32 smc_func_id;
103 u32 __iomem *pluton_start_addr;
104 u32 __iomem *pluton_reply_addr;
105 u8 ffa_flags;
106 u8 ffa_attributes;
107 };
108
109 struct tpm2_crb_smc {
110 u32 interrupt;
111 u8 interrupt_flags;
112 u8 op_flags;
113 u16 reserved2;
114 u32 smc_func_id;
115 };
116
117 /* CRB over FFA start method parameters in TCG2 ACPI table */
118 struct tpm2_crb_ffa {
119 u8 flags;
120 u8 attributes;
121 u16 partition_id;
122 u8 reserved[8];
123 };
124
125 struct tpm2_crb_pluton {
126 u64 start_addr;
127 u64 reply_addr;
128 };
129
130 /*
131 * Returns true if the start method supports idle.
132 */
tpm_crb_has_idle(u32 start_method)133 static inline bool tpm_crb_has_idle(u32 start_method)
134 {
135 return !(start_method == ACPI_TPM2_START_METHOD ||
136 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD ||
137 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC);
138 }
139
crb_wait_for_reg_32(u32 __iomem * reg,u32 mask,u32 value,unsigned long timeout)140 static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
141 unsigned long timeout)
142 {
143 ktime_t start;
144 ktime_t stop;
145
146 start = ktime_get();
147 stop = ktime_add(start, ms_to_ktime(timeout));
148
149 do {
150 if ((ioread32(reg) & mask) == value)
151 return true;
152
153 usleep_range(50, 100);
154 } while (ktime_before(ktime_get(), stop));
155
156 return ((ioread32(reg) & mask) == value);
157 }
158
crb_try_pluton_doorbell(struct crb_priv * priv,bool wait_for_complete)159 static int crb_try_pluton_doorbell(struct crb_priv *priv, bool wait_for_complete)
160 {
161 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON)
162 return 0;
163
164 if (!crb_wait_for_reg_32(priv->pluton_reply_addr, ~0, 1, TPM2_TIMEOUT_C))
165 return -ETIME;
166
167 iowrite32(1, priv->pluton_start_addr);
168 if (wait_for_complete == false)
169 return 0;
170
171 if (!crb_wait_for_reg_32(priv->pluton_start_addr,
172 0xffffffff, 0, 200))
173 return -ETIME;
174
175 return 0;
176 }
177
178 /**
179 * __crb_go_idle - request tpm crb device to go the idle state
180 *
181 * @dev: crb device
182 * @priv: crb private data
183 * @loc: locality
184 *
185 * Write CRB_CTRL_REQ_GO_IDLE to TPM_CRB_CTRL_REQ
186 * The device should respond within TIMEOUT_C by clearing the bit.
187 * Anyhow, we do not wait here as a consequent CMD_READY request
188 * will be handled correctly even if idle was not completed.
189 *
190 * The function does nothing for devices with ACPI-start method
191 * or SMC-start method.
192 *
193 * Return: 0 always
194 */
__crb_go_idle(struct device * dev,struct crb_priv * priv,int loc)195 static int __crb_go_idle(struct device *dev, struct crb_priv *priv, int loc)
196 {
197 int rc;
198
199 if (!tpm_crb_has_idle(priv->sm))
200 return 0;
201
202 iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req);
203
204 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
205 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc);
206 if (rc)
207 return rc;
208 }
209
210 rc = crb_try_pluton_doorbell(priv, true);
211 if (rc)
212 return rc;
213
214 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
215 CRB_CTRL_REQ_GO_IDLE/* mask */,
216 0, /* value */
217 TPM2_TIMEOUT_C)) {
218 dev_warn(dev, "goIdle timed out\n");
219 return -ETIME;
220 }
221
222 return 0;
223 }
224
crb_go_idle(struct tpm_chip * chip)225 static int crb_go_idle(struct tpm_chip *chip)
226 {
227 struct device *dev = &chip->dev;
228 struct crb_priv *priv = dev_get_drvdata(dev);
229
230 return __crb_go_idle(dev, priv, chip->locality);
231 }
232
233 /**
234 * __crb_cmd_ready - request tpm crb device to enter ready state
235 *
236 * @dev: crb device
237 * @priv: crb private data
238 * @loc: locality
239 *
240 * Write CRB_CTRL_REQ_CMD_READY to TPM_CRB_CTRL_REQ
241 * and poll till the device acknowledge it by clearing the bit.
242 * The device should respond within TIMEOUT_C.
243 *
244 * The function does nothing for devices with ACPI-start method
245 * or SMC-start method.
246 *
247 * Return: 0 on success -ETIME on timeout;
248 */
__crb_cmd_ready(struct device * dev,struct crb_priv * priv,int loc)249 static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv, int loc)
250 {
251 int rc;
252
253 if (!tpm_crb_has_idle(priv->sm))
254 return 0;
255
256 iowrite32(CRB_CTRL_REQ_CMD_READY, &priv->regs_t->ctrl_req);
257
258 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
259 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc);
260 if (rc)
261 return rc;
262 }
263
264 rc = crb_try_pluton_doorbell(priv, true);
265 if (rc)
266 return rc;
267
268 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
269 CRB_CTRL_REQ_CMD_READY /* mask */,
270 0, /* value */
271 TPM2_TIMEOUT_C)) {
272 dev_warn(dev, "cmdReady timed out\n");
273 return -ETIME;
274 }
275
276 return 0;
277 }
278
crb_cmd_ready(struct tpm_chip * chip)279 static int crb_cmd_ready(struct tpm_chip *chip)
280 {
281 struct device *dev = &chip->dev;
282 struct crb_priv *priv = dev_get_drvdata(dev);
283
284 return __crb_cmd_ready(dev, priv, chip->locality);
285 }
286
__crb_request_locality(struct device * dev,struct crb_priv * priv,int loc)287 static int __crb_request_locality(struct device *dev,
288 struct crb_priv *priv, int loc)
289 {
290 u32 value = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS;
291 int rc;
292
293 if (!priv->regs_h)
294 return 0;
295
296 iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl);
297
298 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
299 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc);
300 if (rc)
301 return rc;
302 }
303
304 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value,
305 TPM2_TIMEOUT_C)) {
306 dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
307 return -ETIME;
308 }
309
310 return 0;
311 }
312
crb_request_locality(struct tpm_chip * chip,int loc)313 static int crb_request_locality(struct tpm_chip *chip, int loc)
314 {
315 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
316
317 return __crb_request_locality(&chip->dev, priv, loc);
318 }
319
__crb_relinquish_locality(struct device * dev,struct crb_priv * priv,int loc)320 static int __crb_relinquish_locality(struct device *dev,
321 struct crb_priv *priv, int loc)
322 {
323 u32 mask = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS;
324 u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS;
325 int rc;
326
327 if (!priv->regs_h)
328 return 0;
329
330 iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
331
332 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
333 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc);
334 if (rc)
335 return rc;
336 }
337
338 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value,
339 TPM2_TIMEOUT_C)) {
340 dev_warn(dev, "TPM_LOC_STATE_x.Relinquish timed out\n");
341 return -ETIME;
342 }
343
344 return 0;
345 }
346
crb_relinquish_locality(struct tpm_chip * chip,int loc)347 static int crb_relinquish_locality(struct tpm_chip *chip, int loc)
348 {
349 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
350
351 return __crb_relinquish_locality(&chip->dev, priv, loc);
352 }
353
crb_status(struct tpm_chip * chip)354 static u8 crb_status(struct tpm_chip *chip)
355 {
356 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
357 u8 sts = 0;
358
359 if ((ioread32(&priv->regs_t->ctrl_start) & CRB_START_INVOKE) !=
360 CRB_START_INVOKE)
361 sts |= CRB_DRV_STS_COMPLETE;
362
363 return sts;
364 }
365
crb_recv(struct tpm_chip * chip,u8 * buf,size_t count)366 static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
367 {
368 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
369 unsigned int expected;
370
371 /* A sanity check that the upper layer wants to get at least the header
372 * as that is the minimum size for any TPM response.
373 */
374 if (count < TPM_HEADER_SIZE)
375 return -EIO;
376
377 /* If this bit is set, according to the spec, the TPM is in
378 * unrecoverable condition.
379 */
380 if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR)
381 return -EIO;
382
383 /* Read the first 8 bytes in order to get the length of the response.
384 * We read exactly a quad word in order to make sure that the remaining
385 * reads will be aligned.
386 */
387 memcpy_fromio(buf, priv->rsp, 8);
388
389 expected = be32_to_cpup((__be32 *)&buf[2]);
390 if (expected > count || expected < TPM_HEADER_SIZE)
391 return -EIO;
392
393 memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8);
394
395 return expected;
396 }
397
crb_do_acpi_start(struct tpm_chip * chip)398 static int crb_do_acpi_start(struct tpm_chip *chip)
399 {
400 union acpi_object *obj;
401 int rc;
402
403 obj = acpi_evaluate_dsm(chip->acpi_dev_handle,
404 &crb_acpi_start_guid,
405 CRB_ACPI_START_REVISION_ID,
406 CRB_ACPI_START_INDEX,
407 NULL);
408 if (!obj)
409 return -ENXIO;
410 rc = obj->integer.value == 0 ? 0 : -ENXIO;
411 ACPI_FREE(obj);
412 return rc;
413 }
414
415 #ifdef CONFIG_ARM64
416 /*
417 * This is a TPM Command Response Buffer start method that invokes a
418 * Secure Monitor Call to request the firmware to execute or cancel
419 * a TPM 2.0 command.
420 */
tpm_crb_smc_start(struct device * dev,unsigned long func_id)421 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id)
422 {
423 struct arm_smccc_res res;
424
425 arm_smccc_smc(func_id, 0, 0, 0, 0, 0, 0, 0, &res);
426 if (res.a0 != 0) {
427 dev_err(dev,
428 FW_BUG "tpm_crb_smc_start() returns res.a0 = 0x%lx\n",
429 res.a0);
430 return -EIO;
431 }
432
433 return 0;
434 }
435 #else
tpm_crb_smc_start(struct device * dev,unsigned long func_id)436 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id)
437 {
438 dev_err(dev, FW_BUG "tpm_crb: incorrect start method\n");
439 return -EINVAL;
440 }
441 #endif
442
crb_send(struct tpm_chip * chip,u8 * buf,size_t bufsiz,size_t len)443 static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len)
444 {
445 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
446 int rc = 0;
447
448 /* Zero the cancel register so that the next command will not get
449 * canceled.
450 */
451 iowrite32(0, &priv->regs_t->ctrl_cancel);
452
453 if (len > priv->cmd_size) {
454 dev_err(&chip->dev, "invalid command count value %zd %d\n",
455 len, priv->cmd_size);
456 return -E2BIG;
457 }
458
459 /* Seems to be necessary for every command */
460 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON)
461 __crb_cmd_ready(&chip->dev, priv, chip->locality);
462
463 memcpy_toio(priv->cmd, buf, len);
464
465 /* Make sure that cmd is populated before issuing start. */
466 wmb();
467
468 /* The reason for the extra quirk is that the PTT in 4th Gen Core CPUs
469 * report only ACPI start but in practice seems to require both
470 * CRB start, hence invoking CRB start method if hid == MSFT0101.
471 */
472 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER ||
473 priv->sm == ACPI_TPM2_MEMORY_MAPPED ||
474 !strcmp(priv->hid, "MSFT0101"))
475 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start);
476
477 if (priv->sm == ACPI_TPM2_START_METHOD ||
478 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD)
479 rc = crb_do_acpi_start(chip);
480
481 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
482 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start);
483 rc = tpm_crb_smc_start(&chip->dev, priv->smc_func_id);
484 }
485
486 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
487 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start);
488 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality);
489 }
490
491 if (rc)
492 return rc;
493
494 return crb_try_pluton_doorbell(priv, false);
495 }
496
crb_cancel(struct tpm_chip * chip)497 static void crb_cancel(struct tpm_chip *chip)
498 {
499 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
500 int rc;
501
502 iowrite32(CRB_CANCEL_INVOKE, &priv->regs_t->ctrl_cancel);
503
504 if ((priv->sm == ACPI_TPM2_START_METHOD ||
505 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) &&
506 crb_do_acpi_start(chip))
507 dev_err(&chip->dev, "ACPI Start failed\n");
508
509 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
510 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality);
511 if (rc)
512 dev_err(&chip->dev, "FF-A Start failed\n");
513 }
514 }
515
crb_req_canceled(struct tpm_chip * chip,u8 status)516 static bool crb_req_canceled(struct tpm_chip *chip, u8 status)
517 {
518 struct crb_priv *priv = dev_get_drvdata(&chip->dev);
519 u32 cancel = ioread32(&priv->regs_t->ctrl_cancel);
520
521 return (cancel & CRB_CANCEL_INVOKE) == CRB_CANCEL_INVOKE;
522 }
523
524 static const struct tpm_class_ops tpm_crb = {
525 .flags = TPM_OPS_AUTO_STARTUP,
526 .status = crb_status,
527 .recv = crb_recv,
528 .send = crb_send,
529 .cancel = crb_cancel,
530 .req_canceled = crb_req_canceled,
531 .go_idle = crb_go_idle,
532 .cmd_ready = crb_cmd_ready,
533 .request_locality = crb_request_locality,
534 .relinquish_locality = crb_relinquish_locality,
535 .req_complete_mask = CRB_DRV_STS_COMPLETE,
536 .req_complete_val = CRB_DRV_STS_COMPLETE,
537 };
538
crb_check_resource(struct acpi_resource * ares,void * data)539 static int crb_check_resource(struct acpi_resource *ares, void *data)
540 {
541 struct resource *iores_array = data;
542 struct resource_win win;
543 struct resource *res = &(win.res);
544 int i;
545
546 if (acpi_dev_resource_memory(ares, res) ||
547 acpi_dev_resource_address_space(ares, &win)) {
548 for (i = 0; i < TPM_CRB_MAX_RESOURCES + 1; ++i) {
549 if (resource_type(iores_array + i) != IORESOURCE_MEM) {
550 iores_array[i] = *res;
551 iores_array[i].name = NULL;
552 break;
553 }
554 }
555 }
556
557 return 1;
558 }
559
crb_map_res(struct device * dev,struct resource * iores,void __iomem ** iobase_ptr,u64 start,u32 size)560 static void __iomem *crb_map_res(struct device *dev, struct resource *iores,
561 void __iomem **iobase_ptr, u64 start, u32 size)
562 {
563 struct resource new_res = {
564 .start = start,
565 .end = start + size - 1,
566 .flags = IORESOURCE_MEM,
567 };
568
569 /* Detect a 64 bit address on a 32 bit system */
570 if (start != new_res.start)
571 return IOMEM_ERR_PTR(-EINVAL);
572
573 if (!iores)
574 return devm_ioremap_resource(dev, &new_res);
575
576 if (!*iobase_ptr) {
577 *iobase_ptr = devm_ioremap_resource(dev, iores);
578 if (IS_ERR(*iobase_ptr))
579 return *iobase_ptr;
580 }
581
582 return *iobase_ptr + (new_res.start - iores->start);
583 }
584
585 /*
586 * Work around broken BIOSs that return inconsistent values from the ACPI
587 * region vs the registers. Trust the ACPI region. Such broken systems
588 * probably cannot send large TPM commands since the buffer will be truncated.
589 */
crb_fixup_cmd_size(struct device * dev,struct resource * io_res,u64 start,u64 size)590 static u64 crb_fixup_cmd_size(struct device *dev, struct resource *io_res,
591 u64 start, u64 size)
592 {
593 if (io_res->start > start || io_res->end < start)
594 return size;
595
596 if (start + size - 1 <= io_res->end)
597 return size;
598
599 dev_err(dev,
600 FW_BUG "ACPI region does not cover the entire command/response buffer. %pr vs %llx %llx\n",
601 io_res, start, size);
602
603 return io_res->end - start + 1;
604 }
605
crb_map_io(struct device * dev,struct crb_priv * priv,struct acpi_table_tpm2 * buf)606 static int crb_map_io(struct device *dev, struct crb_priv *priv,
607 struct acpi_table_tpm2 *buf)
608 {
609 struct acpi_device *device = ACPI_COMPANION(dev);
610 struct list_head acpi_resource_list;
611 struct resource iores_array[TPM_CRB_MAX_RESOURCES + 1] = { {0} };
612 void __iomem *iobase_array[TPM_CRB_MAX_RESOURCES] = {NULL};
613 struct resource *iores;
614 void __iomem **iobase_ptr;
615 int i;
616 u32 pa_high, pa_low;
617 u64 cmd_pa;
618 u32 cmd_size;
619 __le64 __rsp_pa;
620 u64 rsp_pa;
621 u32 rsp_size;
622 int ret;
623
624 /*
625 * Pluton sometimes does not define ACPI memory regions.
626 * Mapping is then done in crb_map_pluton
627 */
628 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
629 INIT_LIST_HEAD(&acpi_resource_list);
630 ret = acpi_dev_get_resources(device, &acpi_resource_list,
631 crb_check_resource, iores_array);
632 if (ret < 0)
633 return ret;
634 acpi_dev_free_resource_list(&acpi_resource_list);
635
636 if (resource_type(iores_array) != IORESOURCE_MEM) {
637 dev_err(dev, FW_BUG "TPM2 ACPI table does not define a memory resource\n");
638 return -EINVAL;
639 } else if (resource_type(iores_array + TPM_CRB_MAX_RESOURCES) ==
640 IORESOURCE_MEM) {
641 dev_warn(dev, "TPM2 ACPI table defines too many memory resources\n");
642 memset(iores_array + TPM_CRB_MAX_RESOURCES,
643 0, sizeof(*iores_array));
644 iores_array[TPM_CRB_MAX_RESOURCES].flags = 0;
645 }
646 }
647
648 iores = NULL;
649 iobase_ptr = NULL;
650 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) {
651 if (buf->control_address >= iores_array[i].start &&
652 buf->control_address + sizeof(struct crb_regs_tail) - 1 <=
653 iores_array[i].end) {
654 iores = iores_array + i;
655 iobase_ptr = iobase_array + i;
656 break;
657 }
658 }
659
660 priv->regs_t = crb_map_res(dev, iores, iobase_ptr, buf->control_address,
661 sizeof(struct crb_regs_tail));
662
663 if (IS_ERR(priv->regs_t))
664 return PTR_ERR(priv->regs_t);
665
666 /* The ACPI IO region starts at the head area and continues to include
667 * the control area, as one nice sane region except for some older
668 * stuff that puts the control area outside the ACPI IO region.
669 */
670 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER ||
671 priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA ||
672 priv->sm == ACPI_TPM2_MEMORY_MAPPED) {
673 if (iores &&
674 buf->control_address == iores->start +
675 sizeof(*priv->regs_h))
676 priv->regs_h = *iobase_ptr;
677 else
678 dev_warn(dev, FW_BUG "Bad ACPI memory layout");
679 }
680
681 ret = __crb_request_locality(dev, priv, 0);
682 if (ret)
683 return ret;
684
685 /*
686 * PTT HW bug w/a: wake up the device to access
687 * possibly not retained registers.
688 */
689 ret = __crb_cmd_ready(dev, priv, 0);
690 if (ret)
691 goto out_relinquish_locality;
692
693 pa_high = ioread32(&priv->regs_t->ctrl_cmd_pa_high);
694 pa_low = ioread32(&priv->regs_t->ctrl_cmd_pa_low);
695 cmd_pa = ((u64)pa_high << 32) | pa_low;
696 cmd_size = ioread32(&priv->regs_t->ctrl_cmd_size);
697
698 iores = NULL;
699 iobase_ptr = NULL;
700 for (i = 0; iores_array[i].end; ++i) {
701 if (cmd_pa >= iores_array[i].start &&
702 cmd_pa <= iores_array[i].end) {
703 iores = iores_array + i;
704 iobase_ptr = iobase_array + i;
705 break;
706 }
707 }
708
709 if (iores)
710 cmd_size = crb_fixup_cmd_size(dev, iores, cmd_pa, cmd_size);
711
712 dev_dbg(dev, "cmd_hi = %X cmd_low = %X cmd_size %X\n",
713 pa_high, pa_low, cmd_size);
714
715 priv->cmd = crb_map_res(dev, iores, iobase_ptr, cmd_pa, cmd_size);
716 if (IS_ERR(priv->cmd)) {
717 ret = PTR_ERR(priv->cmd);
718 goto out;
719 }
720
721 memcpy_fromio(&__rsp_pa, &priv->regs_t->ctrl_rsp_pa, 8);
722 rsp_pa = le64_to_cpu(__rsp_pa);
723 rsp_size = ioread32(&priv->regs_t->ctrl_rsp_size);
724
725 iores = NULL;
726 iobase_ptr = NULL;
727 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) {
728 if (rsp_pa >= iores_array[i].start &&
729 rsp_pa <= iores_array[i].end) {
730 iores = iores_array + i;
731 iobase_ptr = iobase_array + i;
732 break;
733 }
734 }
735
736 if (iores)
737 rsp_size = crb_fixup_cmd_size(dev, iores, rsp_pa, rsp_size);
738
739 if (cmd_pa != rsp_pa) {
740 priv->rsp = crb_map_res(dev, iores, iobase_ptr,
741 rsp_pa, rsp_size);
742 ret = PTR_ERR_OR_ZERO(priv->rsp);
743 goto out;
744 }
745
746 /* According to the PTP specification, overlapping command and response
747 * buffer sizes must be identical.
748 */
749 if (cmd_size != rsp_size) {
750 dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
751 ret = -EINVAL;
752 goto out;
753 }
754
755 priv->rsp = priv->cmd;
756
757 out:
758 if (!ret)
759 priv->cmd_size = cmd_size;
760
761 __crb_go_idle(dev, priv, 0);
762
763 out_relinquish_locality:
764
765 __crb_relinquish_locality(dev, priv, 0);
766
767 return ret;
768 }
769
crb_map_pluton(struct device * dev,struct crb_priv * priv,struct acpi_table_tpm2 * buf,struct tpm2_crb_pluton * crb_pluton)770 static int crb_map_pluton(struct device *dev, struct crb_priv *priv,
771 struct acpi_table_tpm2 *buf, struct tpm2_crb_pluton *crb_pluton)
772 {
773 priv->pluton_start_addr = crb_map_res(dev, NULL, NULL,
774 crb_pluton->start_addr, 4);
775 if (IS_ERR(priv->pluton_start_addr))
776 return PTR_ERR(priv->pluton_start_addr);
777
778 priv->pluton_reply_addr = crb_map_res(dev, NULL, NULL,
779 crb_pluton->reply_addr, 4);
780 if (IS_ERR(priv->pluton_reply_addr))
781 return PTR_ERR(priv->pluton_reply_addr);
782
783 return 0;
784 }
785
crb_acpi_probe(struct platform_device * pdev)786 static int crb_acpi_probe(struct platform_device *pdev)
787 {
788 struct device *dev = &pdev->dev;
789 struct acpi_device *device = ACPI_COMPANION(dev);
790 struct acpi_table_tpm2 *buf;
791 struct crb_priv *priv;
792 struct tpm_chip *chip;
793 struct tpm2_crb_smc *crb_smc;
794 struct tpm2_crb_ffa *crb_ffa;
795 struct tpm2_crb_pluton *crb_pluton;
796 acpi_status status;
797 u32 sm;
798 int rc;
799
800 status = acpi_get_table(ACPI_SIG_TPM2, 1,
801 (struct acpi_table_header **) &buf);
802 if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) {
803 dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n");
804 return -EINVAL;
805 }
806
807 /* Should the FIFO driver handle this? */
808 sm = buf->start_method;
809 if (sm == ACPI_TPM2_MEMORY_MAPPED) {
810 rc = -ENODEV;
811 goto out;
812 }
813
814 priv = devm_kzalloc(dev, sizeof(struct crb_priv), GFP_KERNEL);
815 if (!priv) {
816 rc = -ENOMEM;
817 goto out;
818 }
819
820 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
821 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_smc))) {
822 dev_err(dev,
823 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
824 buf->header.length,
825 ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC);
826 rc = -EINVAL;
827 goto out;
828 }
829 crb_smc = ACPI_ADD_PTR(struct tpm2_crb_smc, buf, sizeof(*buf));
830 priv->smc_func_id = crb_smc->smc_func_id;
831 }
832
833 if (sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
834 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_ffa))) {
835 dev_err(dev,
836 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
837 buf->header.length,
838 ACPI_TPM2_CRB_WITH_ARM_FFA);
839 rc = -EINVAL;
840 goto out;
841 }
842 crb_ffa = ACPI_ADD_PTR(struct tpm2_crb_ffa, buf, sizeof(*buf));
843 priv->ffa_flags = crb_ffa->flags;
844 priv->ffa_attributes = crb_ffa->attributes;
845 rc = tpm_crb_ffa_init();
846 if (rc) {
847 /* If FF-A driver is not available yet, request probe retry */
848 if (rc == -ENOENT)
849 rc = -EPROBE_DEFER;
850 goto out;
851 }
852 }
853
854 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
855 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_pluton))) {
856 dev_err(dev,
857 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
858 buf->header.length,
859 ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON);
860 rc = -EINVAL;
861 goto out;
862 }
863 crb_pluton = ACPI_ADD_PTR(struct tpm2_crb_pluton, buf, sizeof(*buf));
864 rc = crb_map_pluton(dev, priv, buf, crb_pluton);
865 if (rc)
866 goto out;
867 }
868
869 priv->sm = sm;
870 priv->hid = acpi_device_hid(device);
871
872 rc = crb_map_io(dev, priv, buf);
873 if (rc)
874 goto out;
875
876 chip = tpmm_chip_alloc(dev, &tpm_crb);
877 if (IS_ERR(chip)) {
878 rc = PTR_ERR(chip);
879 goto out;
880 }
881
882 dev_set_drvdata(&chip->dev, priv);
883 chip->acpi_dev_handle = device->handle;
884 chip->flags = TPM_CHIP_FLAG_TPM2;
885
886 rc = tpm_chip_bootstrap(chip);
887 if (rc)
888 goto out;
889
890 #ifdef CONFIG_X86
891 /* A quirk for https://www.amd.com/en/support/kb/faq/pa-410 */
892 if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
893 priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
894 dev_info(dev, "Disabling hwrng\n");
895 chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED;
896 }
897 #endif /* CONFIG_X86 */
898
899 rc = tpm_chip_register(chip);
900
901 out:
902 acpi_put_table((struct acpi_table_header *)buf);
903 return rc;
904 }
905
crb_acpi_remove(struct platform_device * pdev)906 static void crb_acpi_remove(struct platform_device *pdev)
907 {
908 tpm_chip_unregister(platform_get_drvdata(pdev));
909 }
910
911 static const struct dev_pm_ops crb_pm = {
912 SET_SYSTEM_SLEEP_PM_OPS(tpm_pm_suspend, tpm_pm_resume)
913 };
914
915 static const struct acpi_device_id crb_device_ids[] = {
916 {"MSFT0101", 0},
917 {"", 0},
918 };
919 MODULE_DEVICE_TABLE(acpi, crb_device_ids);
920
921 static struct platform_driver crb_acpi_driver = {
922 .probe = crb_acpi_probe,
923 .remove = crb_acpi_remove,
924 .driver = {
925 .name = "tpm_crb_acpi",
926 .acpi_match_table = crb_device_ids,
927 .pm = &crb_pm,
928 },
929 };
930
931 module_platform_driver(crb_acpi_driver);
932 MODULE_AUTHOR("Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>");
933 MODULE_DESCRIPTION("TPM2 Driver");
934 MODULE_VERSION("0.1");
935 MODULE_LICENSE("GPL");
936