1 /* 2 * Copyright (c) 2008, 2009 Michael Shalayeff 3 * Copyright (c) 2009, 2010 Hans-Joerg Hoexer 4 * All rights reserved. 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN 15 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT 16 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 /* #define TPM_DEBUG */ 20 21 #include <sys/param.h> 22 #include <sys/systm.h> 23 #include <sys/endian.h> 24 #include <sys/kernel.h> 25 #include <sys/malloc.h> 26 #include <sys/proc.h> 27 28 #include <sys/module.h> 29 #include <sys/conf.h> 30 #include <sys/uio.h> 31 #include <sys/bus.h> 32 33 #include <machine/bus.h> 34 #include <sys/rman.h> 35 #include <machine/resource.h> 36 37 #include <machine/md_var.h> 38 39 #include <isa/isareg.h> 40 #include <isa/isavar.h> 41 #include <dev/tpm/tpmvar.h> 42 43 MALLOC_DEFINE(M_TPM, "tpm12_buffer", "buffer for TPM 1.2 responses"); 44 45 #define TPM_BUFSIZ 1024 46 47 #define TPM_HDRSIZE 10 48 49 #define TPM_PARAM_SIZE 0x0001 50 51 #define TPM_TAG_RQU_COMMAND 0x00c1 52 #define TPM_TAG_RSP_COMMAND 0x00c4 53 #define TPM_ORD_SAVESTATE 0x00000098 54 #define TPM_WARN_RETRY 0x00000800 55 56 #define TPM_SAVESTATE_RETRIES 50 57 #define TPM_SAVESTATE_RETRY_MS 100 58 59 #define IRQUNK -1 60 61 #define TPM_ACCESS 0x0000 /* access register */ 62 #define TPM_ACCESS_ESTABLISHMENT 0x01 /* establishment */ 63 #define TPM_ACCESS_REQUEST_USE 0x02 /* request using locality */ 64 #define TPM_ACCESS_REQUEST_PENDING 0x04 /* pending request */ 65 #define TPM_ACCESS_SEIZE 0x08 /* request locality seize */ 66 #define TPM_ACCESS_SEIZED 0x10 /* locality has been seized */ 67 #define TPM_ACCESS_ACTIVE_LOCALITY 0x20 /* locality is active */ 68 #define TPM_ACCESS_VALID 0x80 /* bits are valid */ 69 #define TPM_ACCESS_BITS \ 70 "\020\01EST\02REQ\03PEND\04SEIZE\05SEIZED\06ACT\010VALID" 71 72 #define TPM_INTERRUPT_ENABLE 0x0008 73 #define TPM_GLOBAL_INT_ENABLE 0x80000000 /* enable ints */ 74 #define TPM_CMD_READY_INT 0x00000080 /* cmd ready enable */ 75 #define TPM_INT_EDGE_FALLING 0x00000018 76 #define TPM_INT_EDGE_RISING 0x00000010 77 #define TPM_INT_LEVEL_LOW 0x00000008 78 #define TPM_INT_LEVEL_HIGH 0x00000000 79 #define TPM_LOCALITY_CHANGE_INT 0x00000004 /* locality change enable */ 80 #define TPM_STS_VALID_INT 0x00000002 /* int on TPM_STS_VALID is set */ 81 #define TPM_DATA_AVAIL_INT 0x00000001 /* int on TPM_STS_DATA_AVAIL is set */ 82 #define TPM_INTERRUPT_ENABLE_BITS \ 83 "\020\040ENA\010RDY\03LOCH\02STSV\01DRDY" 84 85 #define TPM_INT_VECTOR 0x000c /* 8 bit reg for 4 bit irq vector */ 86 #define TPM_INT_STATUS 0x0010 /* bits are & 0x87 from TPM_INTERRUPT_ENABLE */ 87 88 #define TPM_INTF_CAPABILITIES 0x0014 /* capability register */ 89 #define TPM_INTF_BURST_COUNT_STATIC 0x0100 /* TPM_STS_BMASK static */ 90 #define TPM_INTF_CMD_READY_INT 0x0080 /* int on ready supported */ 91 #define TPM_INTF_INT_EDGE_FALLING 0x0040 /* falling edge ints supported */ 92 #define TPM_INTF_INT_EDGE_RISING 0x0020 /* rising edge ints supported */ 93 #define TPM_INTF_INT_LEVEL_LOW 0x0010 /* level-low ints supported */ 94 #define TPM_INTF_INT_LEVEL_HIGH 0x0008 /* level-high ints supported */ 95 #define TPM_INTF_LOCALITY_CHANGE_INT 0x0004 /* locality-change int (mb 1) */ 96 #define TPM_INTF_STS_VALID_INT 0x0002 /* TPM_STS_VALID int supported */ 97 #define TPM_INTF_DATA_AVAIL_INT 0x0001 /* TPM_STS_DATA_AVAIL int supported (mb 1) */ 98 #define TPM_CAPSREQ \ 99 (TPM_INTF_DATA_AVAIL_INT|TPM_INTF_LOCALITY_CHANGE_INT|TPM_INTF_INT_LEVEL_LOW) 100 #define TPM_CAPBITS \ 101 "\020\01IDRDY\02ISTSV\03ILOCH\04IHIGH\05ILOW\06IEDGE\07IFALL\010IRDY\011BCST" 102 103 #define TPM_STS 0x0018 /* status register */ 104 #define TPM_STS_MASK 0x000000ff /* status bits */ 105 #define TPM_STS_BMASK 0x00ffff00 /* ro io burst size */ 106 #define TPM_STS_VALID 0x00000080 /* ro other bits are valid */ 107 #define TPM_STS_CMD_READY 0x00000040 /* rw chip/signal ready */ 108 #define TPM_STS_GO 0x00000020 /* wo start the command */ 109 #define TPM_STS_DATA_AVAIL 0x00000010 /* ro data available */ 110 #define TPM_STS_DATA_EXPECT 0x00000008 /* ro more data to be written */ 111 #define TPM_STS_RESP_RETRY 0x00000002 /* wo resend the response */ 112 #define TPM_STS_BITS "\020\010VALID\07RDY\06GO\05DRDY\04EXPECT\02RETRY" 113 114 #define TPM_DATA 0x0024 115 #define TPM_ID 0x0f00 116 #define TPM_REV 0x0f04 117 #define TPM_SIZE 0x5000 /* five pages of the above */ 118 119 #define TPM_ACCESS_TMO 2000 /* 2sec */ 120 #define TPM_READY_TMO 2000 /* 2sec */ 121 #define TPM_READ_TMO 120000 /* 2 minutes */ 122 #define TPM_BURST_TMO 2000 /* 2sec */ 123 124 #define TPM_LEGACY_BUSY 0x01 125 #define TPM_LEGACY_ABRT 0x01 126 #define TPM_LEGACY_DA 0x02 127 #define TPM_LEGACY_RE 0x04 128 #define TPM_LEGACY_LAST 0x04 129 #define TPM_LEGACY_BITS "\020\01BUSY\2DA\3RE\4LAST" 130 #define TPM_LEGACY_TMO (2*60) /* sec */ 131 #define TPM_LEGACY_SLEEP 5 /* ticks */ 132 #define TPM_LEGACY_DELAY 100 133 134 /* Set when enabling legacy interface in host bridge. */ 135 int tpm_enabled; 136 137 #define TPMSOFTC(dev) \ 138 ((struct tpm_softc *)dev->si_drv1) 139 140 d_open_t tpmopen; 141 d_close_t tpmclose; 142 d_read_t tpmread; 143 d_write_t tpmwrite; 144 d_ioctl_t tpmioctl; 145 146 static struct cdevsw tpm_cdevsw = { 147 .d_version = D_VERSION, 148 .d_open = tpmopen, 149 .d_close = tpmclose, 150 .d_read = tpmread, 151 .d_write = tpmwrite, 152 .d_ioctl = tpmioctl, 153 .d_name = "tpm", 154 }; 155 156 const struct { 157 u_int32_t devid; 158 char name[32]; 159 int flags; 160 #define TPM_DEV_NOINTS 0x0001 161 } tpm_devs[] = { 162 { 0x000615d1, "IFX SLD 9630 TT 1.1", 0 }, 163 { 0x000b15d1, "IFX SLB 9635 TT 1.2", 0 }, 164 { 0x100214e4, "Broadcom BCM0102", TPM_DEV_NOINTS }, 165 { 0x00fe1050, "WEC WPCT200", 0 }, 166 { 0x687119fa, "SNS SSX35", 0 }, 167 { 0x2e4d5453, "STM ST19WP18", 0 }, 168 { 0x32021114, "ATML 97SC3203", TPM_DEV_NOINTS }, 169 { 0x10408086, "INTEL INTC0102", 0 }, 170 { 0, "", TPM_DEV_NOINTS }, 171 }; 172 173 int tpm_tis12_irqinit(struct tpm_softc *, int, int); 174 int tpm_tis12_init(struct tpm_softc *, int, const char *); 175 int tpm_tis12_start(struct tpm_softc *, int); 176 int tpm_tis12_read(struct tpm_softc *, void *, int, size_t *, int); 177 int tpm_tis12_write(struct tpm_softc *, void *, int); 178 int tpm_tis12_end(struct tpm_softc *, int, int); 179 180 void tpm_intr(void *); 181 182 int tpm_waitfor_poll(struct tpm_softc *, u_int8_t, int, void *); 183 int tpm_waitfor_int(struct tpm_softc *, u_int8_t, int, int); 184 int tpm_waitfor(struct tpm_softc *, u_int8_t, int, void *); 185 int tpm_request_locality(struct tpm_softc *, int); 186 int tpm_getburst(struct tpm_softc *); 187 u_int8_t tpm_status(struct tpm_softc *); 188 int tpm_tmotohz(int); 189 190 int tpm_legacy_probe(bus_space_tag_t, bus_addr_t); 191 int tpm_legacy_init(struct tpm_softc *, int, const char *); 192 int tpm_legacy_start(struct tpm_softc *, int); 193 int tpm_legacy_read(struct tpm_softc *, void *, int, size_t *, int); 194 int tpm_legacy_write(struct tpm_softc *, void *, int); 195 int tpm_legacy_end(struct tpm_softc *, int, int); 196 197 static int tpm_transmit_header(struct tpm_softc *, uint32_t, uint32_t *); 198 static void tpm_tis12_abort(struct tpm_softc *); 199 static int tpm_tis12_devid_index(uint32_t); 200 static void tpm_tis12_relinquish_locality(struct tpm_softc *); 201 static int tpm_tis12_resume(struct tpm_softc *); 202 203 204 /* 205 * FreeBSD specific code for probing and attaching TPM to device tree. 206 */ 207 #if 0 208 static void 209 tpm_identify(driver_t *driver, device_t parent) 210 { 211 BUS_ADD_CHILD(parent, ISA_ORDER_SPECULATIVE, "tpm", 0); 212 } 213 #endif 214 215 int 216 tpm_attach(device_t dev) 217 { 218 struct make_dev_args args; 219 struct tpm_softc *sc; 220 int error, irq; 221 222 sc = device_get_softc(dev); 223 sx_init(&sc->sc_lock, "TPM driver lock"); 224 mtx_init(&sc->sc_intr_lock, "TPM interrupt lock", NULL, MTX_DEF); 225 cv_init(&sc->sc_intr_cv, "tpm_intr"); 226 sc->intr_cookie = NULL; 227 sc->sc_cdev = NULL; 228 sc->sc_flags = 0; 229 sc->sc_suspend = 0; 230 sc->sc_dying = false; 231 sc->sc_locality = false; 232 sc->sc_command_pending = false; 233 234 sc->mem_rid = 0; 235 sc->mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid, 236 RF_ACTIVE); 237 if (sc->mem_res == NULL) { 238 error = ENXIO; 239 goto fail; 240 } 241 242 sc->sc_bt = rman_get_bustag(sc->mem_res); 243 sc->sc_bh = rman_get_bushandle(sc->mem_res); 244 245 sc->irq_rid = 0; 246 sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid, 247 RF_ACTIVE | RF_SHAREABLE); 248 if (sc->irq_res != NULL) 249 irq = rman_get_start(sc->irq_res); 250 else 251 irq = IRQUNK; 252 253 if (tpm_legacy_probe(sc->sc_bt, sc->sc_bh)) { 254 sc->sc_init = tpm_legacy_init; 255 sc->sc_start = tpm_legacy_start; 256 sc->sc_read = tpm_legacy_read; 257 sc->sc_write = tpm_legacy_write; 258 sc->sc_end = tpm_legacy_end; 259 } else { 260 sc->sc_init = tpm_tis12_init; 261 sc->sc_start = tpm_tis12_start; 262 sc->sc_read = tpm_tis12_read; 263 sc->sc_write = tpm_tis12_write; 264 sc->sc_end = tpm_tis12_end; 265 } 266 267 printf("%s", device_get_name(dev)); 268 sx_xlock(&sc->sc_lock); 269 error = sc->sc_init(sc, irq, "tpm"); 270 sx_xunlock(&sc->sc_lock); 271 if (error != 0) { 272 error = ENXIO; 273 goto fail; 274 } 275 276 if (sc->sc_init == tpm_tis12_init && sc->irq_res != NULL && 277 bus_setup_intr(dev, sc->irq_res, INTR_TYPE_TTY | INTR_MPSAFE, NULL, 278 tpm_intr, sc, &sc->intr_cookie) != 0) { 279 printf(": cannot establish interrupt\n"); 280 error = ENXIO; 281 goto fail; 282 } 283 284 make_dev_args_init(&args); 285 args.mda_devsw = &tpm_cdevsw; 286 args.mda_unit = device_get_unit(dev); 287 args.mda_uid = UID_ROOT; 288 args.mda_gid = GID_WHEEL; 289 args.mda_mode = 0600; 290 args.mda_si_drv1 = sc; 291 error = make_dev_s(&args, &sc->sc_cdev, "tpm"); 292 if (error != 0) 293 goto fail; 294 295 return (0); 296 297 fail: 298 tpm_detach(dev); 299 return (error); 300 } 301 302 int 303 tpm_detach(device_t dev) 304 { 305 struct tpm_softc *sc; 306 307 sc = device_get_softc(dev); 308 sx_xlock(&sc->sc_lock); 309 sc->sc_dying = true; 310 sx_xunlock(&sc->sc_lock); 311 312 /* 313 * Prevent new methods from touching the transport. Do not hold the 314 * lock while destroy_dev() drains methods already waiting for it. 315 */ 316 if (sc->sc_cdev != NULL) { 317 destroy_dev(sc->sc_cdev); 318 sc->sc_cdev = NULL; 319 } 320 sx_xlock(&sc->sc_lock); 321 if (sc->mem_res != NULL && sc->sc_init == tpm_tis12_init) 322 tpm_tis12_abort(sc); 323 sx_xunlock(&sc->sc_lock); 324 if (sc->intr_cookie != NULL) { 325 bus_teardown_intr(dev, sc->irq_res, sc->intr_cookie); 326 sc->intr_cookie = NULL; 327 } 328 if (sc->mem_res != NULL) { 329 bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, 330 sc->mem_res); 331 sc->mem_res = NULL; 332 } 333 if (sc->irq_res != NULL) { 334 bus_release_resource(dev, SYS_RES_IRQ, 335 sc->irq_rid, sc->irq_res); 336 sc->irq_res = NULL; 337 } 338 cv_destroy(&sc->sc_intr_cv); 339 mtx_destroy(&sc->sc_intr_lock); 340 sx_destroy(&sc->sc_lock); 341 342 return (0); 343 } 344 345 /* Probe TPM using TIS 1.2 interface. */ 346 int 347 tpm_tis12_probe(bus_space_tag_t bt, bus_space_handle_t bh) 348 { 349 u_int32_t r; 350 u_int8_t reg; 351 bool acquired; 352 int to; 353 354 r = bus_space_read_4(bt, bh, TPM_INTF_CAPABILITIES); 355 if (r == 0xffffffff) 356 return 0; 357 358 #ifdef TPM_DEBUG 359 printf("tpm: caps=%b\n", r, TPM_CAPBITS); 360 #endif 361 if ((r & TPM_CAPSREQ) != TPM_CAPSREQ || 362 !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) { 363 #ifdef TPM_DEBUG 364 printf("tpm: caps too low (caps=%b)\n", r, TPM_CAPBITS); 365 #endif 366 return 0; 367 } 368 369 reg = bus_space_read_1(bt, bh, TPM_ACCESS); 370 acquired = false; 371 if ((reg & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) != 372 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) { 373 bus_space_write_1(bt, bh, TPM_ACCESS, 374 TPM_ACCESS_REQUEST_USE); 375 to = TPM_ACCESS_TMO; /* Steps of one millisecond. */ 376 do { 377 reg = bus_space_read_1(bt, bh, TPM_ACCESS); 378 if ((reg & (TPM_ACCESS_VALID | 379 TPM_ACCESS_ACTIVE_LOCALITY)) == 380 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) { 381 acquired = true; 382 break; 383 } 384 DELAY(1000); 385 } while (--to != 0); 386 } 387 388 if ((reg & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) == 389 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) 390 r = bus_space_read_4(bt, bh, TPM_ID); 391 else 392 r = UINT32_MAX; 393 if (acquired) 394 bus_space_write_1(bt, bh, TPM_ACCESS, 395 TPM_ACCESS_ACTIVE_LOCALITY); 396 return (r != UINT32_MAX); 397 } 398 399 /* 400 * Setup the interrupt vector if one is provided and interrupts are known 401 * to work on that particular chip. The caller must hold locality zero. 402 */ 403 int 404 tpm_tis12_irqinit(struct tpm_softc *sc, int irq, int idx) 405 { 406 u_int32_t r; 407 408 sx_assert(&sc->sc_lock, SA_XLOCKED); 409 mtx_lock(&sc->sc_intr_lock); 410 411 /* Ack and disable all interrupts. */ 412 bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, 413 bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) & 414 ~TPM_GLOBAL_INT_ENABLE); 415 bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS, 416 bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS)); 417 418 if ((irq == IRQUNK) || (tpm_devs[idx].flags & TPM_DEV_NOINTS)) { 419 sc->sc_vector = IRQUNK; 420 mtx_unlock(&sc->sc_intr_lock); 421 return (0); 422 } 423 424 /* Program interrupt vector. */ 425 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_INT_VECTOR, irq); 426 sc->sc_vector = irq; 427 428 /* Program interrupt type. */ 429 if (sc->sc_capabilities & TPM_INTF_INT_EDGE_RISING) 430 r = TPM_INT_EDGE_RISING; 431 else if (sc->sc_capabilities & TPM_INTF_INT_LEVEL_HIGH) 432 r = TPM_INT_LEVEL_HIGH; 433 else 434 r = TPM_INT_LEVEL_LOW; 435 bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, r); 436 437 mtx_unlock(&sc->sc_intr_lock); 438 return (0); 439 } 440 441 static int 442 tpm_tis12_devid_index(uint32_t devid) 443 { 444 int i; 445 446 for (i = 0; tpm_devs[i].devid != 0; i++) 447 if (tpm_devs[i].devid == devid) 448 break; 449 return (i); 450 } 451 452 /* Setup TPM using TIS 1.2 interface. */ 453 int 454 tpm_tis12_init(struct tpm_softc *sc, int irq, const char *name) 455 { 456 u_int32_t r; 457 int error, i; 458 459 sx_assert(&sc->sc_lock, SA_XLOCKED); 460 r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTF_CAPABILITIES); 461 #ifdef TPM_DEBUG 462 printf(" caps=%b ", r, TPM_CAPBITS); 463 #endif 464 if ((r & TPM_CAPSREQ) != TPM_CAPSREQ || 465 !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) { 466 printf(": capabilities too low (caps=%b)\n", r, TPM_CAPBITS); 467 return 1; 468 } 469 sc->sc_capabilities = r; 470 471 sc->sc_devid = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_ID); 472 sc->sc_rev = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_REV); 473 474 i = tpm_tis12_devid_index(sc->sc_devid); 475 476 if (tpm_devs[i].devid) 477 printf(": %s rev 0x%x\n", tpm_devs[i].name, sc->sc_rev); 478 else 479 printf(": device 0x%08x rev 0x%x\n", sc->sc_devid, sc->sc_rev); 480 481 error = tpm_request_locality(sc, 0); 482 if (error != 0) 483 return 1; 484 485 error = tpm_tis12_irqinit(sc, irq, i); 486 if (error != 0) 487 goto out; 488 489 /* Abort whatever it thought it was doing. */ 490 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY); 491 error = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO, 492 sc->sc_write); 493 494 out: 495 tpm_tis12_relinquish_locality(sc); 496 return (error != 0); 497 } 498 499 /* Restore TIS state which is not guaranteed to survive S3. */ 500 static int 501 tpm_tis12_resume(struct tpm_softc *sc) 502 { 503 uint32_t capabilities, devid; 504 int error, i, irq; 505 506 sx_assert(&sc->sc_lock, SA_XLOCKED); 507 capabilities = bus_space_read_4(sc->sc_bt, sc->sc_bh, 508 TPM_INTF_CAPABILITIES); 509 if ((capabilities & TPM_CAPSREQ) != TPM_CAPSREQ || 510 (capabilities & (TPM_INTF_INT_EDGE_RISING | 511 TPM_INTF_INT_LEVEL_LOW)) == 0) 512 return (ENXIO); 513 devid = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_ID); 514 if (devid == UINT32_MAX || devid != sc->sc_devid) 515 return (ENXIO); 516 517 sc->sc_capabilities = capabilities; 518 i = tpm_tis12_devid_index(devid); 519 irq = sc->sc_vector; 520 error = tpm_request_locality(sc, 0); 521 if (error != 0) 522 return (error); 523 error = tpm_tis12_irqinit(sc, irq, i); 524 if (error != 0) 525 goto out; 526 527 /* Abort firmware residue and leave the command FIFO ready. */ 528 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, 529 TPM_STS_CMD_READY); 530 error = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO, 531 sc->sc_write); 532 out: 533 tpm_tis12_relinquish_locality(sc); 534 return (error); 535 } 536 537 int 538 tpm_request_locality(struct tpm_softc *sc, int l) 539 { 540 u_int32_t r; 541 int to, rv; 542 543 sx_assert(&sc->sc_lock, SA_XLOCKED); 544 if (l != 0) 545 return EINVAL; 546 KASSERT(!sc->sc_locality, ("%s: locality already owned", __func__)); 547 548 if ((bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) & 549 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) == 550 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) { 551 sc->sc_locality = true; 552 return 0; 553 } 554 sc->sc_locality = false; 555 556 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS, 557 TPM_ACCESS_REQUEST_USE); 558 559 to = tpm_tmotohz(TPM_ACCESS_TMO); 560 561 while ((r = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) & 562 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) != 563 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY) && to--) { 564 rv = tsleep(sc->sc_init, PRIBIO | PCATCH, "tpm_locality", 1); 565 if (rv && rv != EWOULDBLOCK) { 566 #ifdef TPM_DEBUG 567 printf("tpm_request_locality: interrupted %d\n", rv); 568 #endif 569 r = bus_space_read_1(sc->sc_bt, sc->sc_bh, 570 TPM_ACCESS); 571 if ((r & (TPM_ACCESS_VALID | 572 TPM_ACCESS_ACTIVE_LOCALITY)) == 573 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) { 574 sc->sc_locality = true; 575 tpm_tis12_relinquish_locality(sc); 576 } 577 return rv; 578 } 579 } 580 581 if ((r & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) != 582 (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) { 583 #ifdef TPM_DEBUG 584 printf("tpm_request_locality: access %b\n", r, TPM_ACCESS_BITS); 585 #endif 586 return EBUSY; 587 } 588 589 sc->sc_locality = true; 590 return 0; 591 } 592 593 static void 594 tpm_tis12_relinquish_locality(struct tpm_softc *sc) 595 { 596 597 sx_assert(&sc->sc_lock, SA_XLOCKED); 598 sc->sc_command_pending = false; 599 if (!sc->sc_locality) 600 return; 601 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS, 602 TPM_ACCESS_ACTIVE_LOCALITY); 603 sc->sc_locality = false; 604 } 605 606 static void 607 tpm_tis12_abort(struct tpm_softc *sc) 608 { 609 610 sx_assert(&sc->sc_lock, SA_XLOCKED); 611 if (sc->sc_locality) 612 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, 613 TPM_STS_CMD_READY); 614 tpm_tis12_relinquish_locality(sc); 615 } 616 617 int 618 tpm_getburst(struct tpm_softc *sc) 619 { 620 int burst, to, rv; 621 622 sx_assert(&sc->sc_lock, SA_XLOCKED); 623 to = tpm_tmotohz(TPM_BURST_TMO); 624 625 burst = 0; 626 while (burst == 0 && to--) { 627 /* 628 * Burst count has to be read from bits 8 to 23 without 629 * touching any other bits, eg. the actual status bits 0 630 * to 7. 631 */ 632 burst = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 1); 633 burst |= bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 2) 634 << 8; 635 #ifdef TPM_DEBUG 636 printf("tpm_getburst: read %d\n", burst); 637 #endif 638 if (burst) 639 return burst; 640 641 rv = tsleep(sc, PRIBIO | PCATCH, "tpm_getburst", 1); 642 if (rv && rv != EWOULDBLOCK) { 643 return 0; 644 } 645 } 646 647 return 0; 648 } 649 650 u_int8_t 651 tpm_status(struct tpm_softc *sc) 652 { 653 u_int8_t status; 654 655 status = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS) & 656 TPM_STS_MASK; 657 658 return status; 659 } 660 661 int 662 tpm_tmotohz(int tmo) 663 { 664 struct timeval tv; 665 666 tv.tv_sec = tmo / 1000; 667 tv.tv_usec = 1000 * (tmo % 1000); 668 669 return tvtohz(&tv); 670 } 671 672 /* 673 * Transmit a command with no parameters and consume its header-only reply. 674 */ 675 static int 676 tpm_transmit_header(struct tpm_softc *sc, uint32_t ordinal, uint32_t *tpm_rc) 677 { 678 uint8_t buf[TPM_HDRSIZE]; 679 size_t count; 680 int end_error, error; 681 682 sx_assert(&sc->sc_lock, SA_XLOCKED); 683 be16enc(buf, TPM_TAG_RQU_COMMAND); 684 be32enc(buf + 2, sizeof(buf)); 685 be32enc(buf + 6, ordinal); 686 687 error = sc->sc_start(sc, UIO_WRITE); 688 if (error != 0) 689 return (error); 690 error = sc->sc_write(sc, buf, sizeof(buf)); 691 end_error = sc->sc_end(sc, UIO_WRITE, error); 692 if (error == 0) 693 error = end_error; 694 if (error != 0) 695 return (error); 696 697 error = sc->sc_start(sc, UIO_READ); 698 if (error != 0) 699 return (error); 700 count = 0; 701 error = sc->sc_read(sc, buf, sizeof(buf), &count, TPM_PARAM_SIZE); 702 end_error = sc->sc_end(sc, UIO_READ, error); 703 if (error == 0) 704 error = end_error; 705 if (error != 0) 706 return (error); 707 708 if (count != sizeof(buf) || be16dec(buf) != TPM_TAG_RSP_COMMAND || 709 be32dec(buf + 2) != sizeof(buf)) 710 return (EPROTO); 711 *tpm_rc = be32dec(buf + 6); 712 return (0); 713 } 714 715 /* Save TPM state on suspend. */ 716 int 717 tpm_suspend(device_t dev) 718 { 719 struct tpm_softc *sc; 720 uint32_t tpm_rc; 721 int error, tries; 722 723 /* 724 * A TPM may report RETRY for several seconds when firmware issued 725 * SaveState before the driver loaded. Any subsequent command can 726 * invalidate that saved state, so retry SaveState before entering S3. 727 */ 728 sc = device_get_softc(dev); 729 sx_xlock(&sc->sc_lock); 730 if (sc->sc_dying) { 731 error = ENXIO; 732 goto out; 733 } 734 if (sc->sc_suspend != 0) { 735 error = 0; 736 goto out; 737 } 738 for (tries = 0; tries < TPM_SAVESTATE_RETRIES; tries++) { 739 error = tpm_transmit_header(sc, TPM_ORD_SAVESTATE, &tpm_rc); 740 if (error != 0 || tpm_rc != TPM_WARN_RETRY) 741 break; 742 pause("tpmsave", MAX(hz * TPM_SAVESTATE_RETRY_MS / 1000, 1)); 743 } 744 if (error != 0) { 745 device_printf(dev, "failed to save state: %d\n", error); 746 goto out; 747 } 748 if (tpm_rc != 0) { 749 device_printf(dev, "SaveState failed: TPM error 0x%x\n", 750 tpm_rc); 751 error = EIO; 752 goto out; 753 } 754 if (tries != 0) 755 device_printf(dev, "SaveState required %d retries\n", tries); 756 #ifdef TPM_DEBUG 757 device_printf(dev, "suspend: %d -> 1\n", sc->sc_suspend); 758 #endif 759 sc->sc_suspend = 1; 760 error = 0; 761 762 out: 763 sx_xunlock(&sc->sc_lock); 764 return (error); 765 } 766 767 /* Handle resume after firmware has restored the saved TPM state. */ 768 int 769 tpm_resume(device_t dev) 770 { 771 struct tpm_softc *sc; 772 int error; 773 774 sc = device_get_softc(dev); 775 sx_xlock(&sc->sc_lock); 776 if (sc->sc_dying) { 777 error = ENXIO; 778 goto out; 779 } 780 error = 0; 781 if (sc->sc_suspend != 0 && sc->sc_init == tpm_tis12_init) 782 error = tpm_tis12_resume(sc); 783 #ifdef TPM_DEBUG 784 device_printf(dev, "resume: %d -> 0\n", sc->sc_suspend); 785 #endif 786 if (error == 0) 787 sc->sc_suspend = 0; 788 if (error != 0) 789 device_printf(dev, "failed to restore TIS state: %d\n", error); 790 791 out: 792 sx_xunlock(&sc->sc_lock); 793 return (error); 794 } 795 796 /* Dispatch suspend and resume events. */ 797 798 /* Wait for given status bits using polling. */ 799 int 800 tpm_waitfor_poll(struct tpm_softc *sc, u_int8_t mask, int tmo, void *c) 801 { 802 int rv; 803 804 sx_assert(&sc->sc_lock, SA_XLOCKED); 805 /* 806 * Poll until either the requested condition or a time out is 807 * met. 808 */ 809 while (((sc->sc_stat = tpm_status(sc)) & mask) != mask && tmo--) { 810 rv = tsleep(c, PRIBIO | PCATCH, "tpm_poll", 1); 811 if (rv && rv != EWOULDBLOCK) { 812 #ifdef TPM_DEBUG 813 printf("tpm_waitfor_poll: interrupted %d\n", rv); 814 #endif 815 return rv; 816 } 817 } 818 819 return 0; 820 } 821 822 /* Wait for given status bits using interrupts. */ 823 int 824 tpm_waitfor_int(struct tpm_softc *sc, u_int8_t mask, int tmo, int inttype) 825 { 826 sbintime_t deadline; 827 int rv; 828 829 sx_assert(&sc->sc_lock, SA_XLOCKED); 830 mtx_lock(&sc->sc_intr_lock); 831 832 /* Poll and return when condition is already met. */ 833 sc->sc_stat = tpm_status(sc); 834 if ((sc->sc_stat & mask) == mask) { 835 rv = 0; 836 goto out; 837 } 838 839 /* 840 * The handler takes sc_intr_lock before acknowledging and waking us, 841 * so an event cannot be lost between the status check and CV wait. 842 */ 843 bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, 844 bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) | 845 inttype); 846 bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, 847 bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) | 848 TPM_GLOBAL_INT_ENABLE); 849 850 /* 851 * Poll once more to remedy the race between previous polling 852 * and enabling interrupts on the tpm chip. 853 */ 854 sc->sc_stat = tpm_status(sc); 855 if ((sc->sc_stat & mask) == mask) { 856 rv = 0; 857 goto disable; 858 } 859 860 deadline = sbinuptime() + mstosbt(tmo); 861 #ifdef TPM_DEBUG 862 printf("tpm_waitfor_int: sleeping for %d ms\n", tmo); 863 #endif 864 do { 865 rv = cv_timedwait_sig_sbt(&sc->sc_intr_cv, 866 &sc->sc_intr_lock, deadline, 0, 867 C_ABSOLUTE | C_HARDCLOCK); 868 sc->sc_stat = tpm_status(sc); 869 if ((sc->sc_stat & mask) == mask) { 870 rv = 0; 871 break; 872 } 873 } while (rv == 0); 874 #ifdef TPM_DEBUG 875 printf("tpm_waitfor_int: woke up with rv %d stat %b\n", rv, 876 sc->sc_stat, TPM_STS_BITS); 877 #endif 878 879 /* Disable interrupts on tpm chip again. */ 880 disable: 881 bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, 882 bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) & 883 ~TPM_GLOBAL_INT_ENABLE); 884 bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, 885 bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) & 886 ~inttype); 887 888 out: 889 mtx_unlock(&sc->sc_intr_lock); 890 return (rv); 891 } 892 893 /* 894 * Wait on given status bits, uses interrupts where possible, otherwise polls. 895 */ 896 int 897 tpm_waitfor(struct tpm_softc *sc, u_int8_t b0, int tmo, void *c) 898 { 899 u_int8_t b; 900 int re, to, rv; 901 902 #ifdef TPM_DEBUG 903 printf("tpm_waitfor: b0 %b\n", b0, TPM_STS_BITS); 904 #endif 905 sx_assert(&sc->sc_lock, SA_XLOCKED); 906 907 /* 908 * If possible, use interrupts, otherwise poll. 909 * 910 * We use interrupts for TPM_STS_VALID and TPM_STS_DATA_AVAIL (if 911 * the tpm chips supports them) as waiting for those can take 912 * really long. The other TPM_STS* are not needed very often 913 * so we do not support them. 914 */ 915 if (sc->sc_vector != IRQUNK) { 916 b = b0; 917 918 /* 919 * Wait for data ready. This interrupt only occurs 920 * when both TPM_STS_VALID and TPM_STS_DATA_AVAIL are asserted. 921 * Thus we don't have to bother with TPM_STS_VALID 922 * separately and can just return. 923 * 924 * This only holds for interrupts! When using polling 925 * both flags have to be waited for, see below. 926 */ 927 if ((b & TPM_STS_DATA_AVAIL) && (sc->sc_capabilities & 928 TPM_INTF_DATA_AVAIL_INT)) 929 return tpm_waitfor_int(sc, b, tmo, 930 TPM_DATA_AVAIL_INT); 931 932 /* Wait for status valid bit. */ 933 if ((b & TPM_STS_VALID) && (sc->sc_capabilities & 934 TPM_INTF_STS_VALID_INT)) { 935 rv = tpm_waitfor_int(sc, b, tmo, TPM_STS_VALID_INT); 936 if (rv != 0) 937 return rv; 938 else 939 b = b0 & ~TPM_STS_VALID; 940 } 941 942 /* 943 * When all flags are taken care of, return. Otherwise 944 * use polling for eg. TPM_STS_CMD_READY. 945 */ 946 if (b == 0) 947 return 0; 948 } 949 950 re = 3; 951 restart: 952 /* 953 * If requested wait for TPM_STS_VALID before dealing with 954 * any other flag. Eg. when both TPM_STS_DATA_AVAIL and TPM_STS_VALID 955 * are requested, wait for the latter first. 956 */ 957 b = b0; 958 if (b0 & TPM_STS_VALID) 959 b = TPM_STS_VALID; 960 961 to = tpm_tmotohz(tmo); 962 again: 963 if ((rv = tpm_waitfor_poll(sc, b, to, c)) != 0) 964 return rv; 965 966 if ((b & sc->sc_stat) == TPM_STS_VALID) { 967 /* Now wait for other flags. */ 968 b = b0 & ~TPM_STS_VALID; 969 to++; 970 goto again; 971 } 972 973 if ((sc->sc_stat & b) != b) { 974 #ifdef TPM_DEBUG 975 printf("tpm_waitfor: timeout: stat=%b b=%b\n", 976 sc->sc_stat, TPM_STS_BITS, b, TPM_STS_BITS); 977 #endif 978 if (re-- && (b0 & TPM_STS_VALID)) { 979 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, 980 TPM_STS_RESP_RETRY); 981 goto restart; 982 } 983 return EIO; 984 } 985 986 return 0; 987 } 988 989 /* Start transaction. */ 990 int 991 tpm_tis12_start(struct tpm_softc *sc, int flag) 992 { 993 int rv; 994 995 sx_assert(&sc->sc_lock, SA_XLOCKED); 996 if (flag == UIO_READ) { 997 if (!sc->sc_locality || !sc->sc_command_pending) { 998 tpm_tis12_abort(sc); 999 return (EIO); 1000 } 1001 rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID, 1002 TPM_READ_TMO, sc->sc_read); 1003 if (rv != 0) 1004 tpm_tis12_abort(sc); 1005 return (rv); 1006 } 1007 1008 /* Abort an incomplete command before starting another one. */ 1009 tpm_tis12_abort(sc); 1010 1011 /* Own our (0th) locality. */ 1012 if ((rv = tpm_request_locality(sc, 0)) != 0) 1013 return (rv); 1014 1015 sc->sc_stat = tpm_status(sc); 1016 if (sc->sc_stat & TPM_STS_CMD_READY) { 1017 #ifdef TPM_DEBUG 1018 printf("tpm_tis12_start: UIO_WRITE status %b\n", sc->sc_stat, 1019 TPM_STS_BITS); 1020 #endif 1021 return 0; 1022 } 1023 1024 #ifdef TPM_DEBUG 1025 printf("tpm_tis12_start: UIO_WRITE readying chip\n"); 1026 #endif 1027 1028 /* Abort previous and restart. */ 1029 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY); 1030 if ((rv = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO, 1031 sc->sc_write))) { 1032 #ifdef TPM_DEBUG 1033 printf("tpm_tis12_start: UIO_WRITE readying failed %d\n", rv); 1034 #endif 1035 tpm_tis12_abort(sc); 1036 return (rv); 1037 } 1038 1039 #ifdef TPM_DEBUG 1040 printf("tpm_tis12_start: UIO_WRITE readying done\n"); 1041 #endif 1042 1043 return 0; 1044 } 1045 1046 int 1047 tpm_tis12_read(struct tpm_softc *sc, void *buf, int len, size_t *count, 1048 int flags) 1049 { 1050 u_int8_t *p = buf; 1051 size_t cnt; 1052 int rv, n, bcnt; 1053 1054 #ifdef TPM_DEBUG 1055 printf("tpm_tis12_read: len %d\n", len); 1056 #endif 1057 sx_assert(&sc->sc_lock, SA_XLOCKED); 1058 cnt = 0; 1059 while (len > 0) { 1060 if ((rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID, 1061 TPM_READ_TMO, sc->sc_read))) 1062 return rv; 1063 1064 bcnt = tpm_getburst(sc); 1065 n = MIN(len, bcnt); 1066 #ifdef TPM_DEBUG 1067 printf("tpm_tis12_read: fetching %d, burst is %d\n", n, bcnt); 1068 #endif 1069 for (; n--; len--) { 1070 *p++ = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_DATA); 1071 cnt++; 1072 } 1073 1074 if ((flags & TPM_PARAM_SIZE) == 0 && cnt >= 6) 1075 break; 1076 } 1077 #ifdef TPM_DEBUG 1078 printf("tpm_tis12_read: read %zd bytes, len %d\n", cnt, len); 1079 #endif 1080 1081 if (count) 1082 *count = cnt; 1083 1084 return 0; 1085 } 1086 1087 int 1088 tpm_tis12_write(struct tpm_softc *sc, void *buf, int len) 1089 { 1090 u_int8_t *p = buf; 1091 size_t cnt; 1092 int rv, r; 1093 1094 #ifdef TPM_DEBUG 1095 printf("tpm_tis12_write: sc %p buf %p len %d\n", sc, buf, len); 1096 #endif 1097 1098 sx_assert(&sc->sc_lock, SA_XLOCKED); 1099 if (!sc->sc_locality) 1100 return (EIO); 1101 1102 cnt = 0; 1103 while (cnt < len - 1) { 1104 for (r = tpm_getburst(sc); r > 0 && cnt < len - 1; r--) { 1105 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++); 1106 cnt++; 1107 } 1108 if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) { 1109 #ifdef TPM_DEBUG 1110 printf("tpm_tis12_write: failed burst rv %d\n", rv); 1111 #endif 1112 return rv; 1113 } 1114 sc->sc_stat = tpm_status(sc); 1115 if (!(sc->sc_stat & TPM_STS_DATA_EXPECT)) { 1116 #ifdef TPM_DEBUG 1117 printf("tpm_tis12_write: failed rv %d stat=%b\n", rv, 1118 sc->sc_stat, TPM_STS_BITS); 1119 #endif 1120 return EIO; 1121 } 1122 } 1123 1124 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++); 1125 cnt++; 1126 1127 if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) { 1128 #ifdef TPM_DEBUG 1129 printf("tpm_tis12_write: failed last byte rv %d\n", rv); 1130 #endif 1131 return rv; 1132 } 1133 if ((sc->sc_stat & TPM_STS_DATA_EXPECT) != 0) { 1134 #ifdef TPM_DEBUG 1135 printf("tpm_tis12_write: failed rv %d stat=%b\n", rv, 1136 sc->sc_stat, TPM_STS_BITS); 1137 #endif 1138 return EIO; 1139 } 1140 1141 #ifdef TPM_DEBUG 1142 printf("tpm_tis12_write: wrote %d byte\n", cnt); 1143 #endif 1144 1145 return 0; 1146 } 1147 1148 /* Finish transaction. */ 1149 int 1150 tpm_tis12_end(struct tpm_softc *sc, int flag, int err) 1151 { 1152 int rv = 0; 1153 1154 sx_assert(&sc->sc_lock, SA_XLOCKED); 1155 if (flag == UIO_READ) { 1156 if (!sc->sc_locality) { 1157 tpm_tis12_abort(sc); 1158 return (err != 0 ? 0 : EIO); 1159 } 1160 if (err == 0) 1161 rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, 1162 sc->sc_read); 1163 1164 /* Still more data? */ 1165 if (err == 0 && rv == 0) 1166 sc->sc_stat = tpm_status(sc); 1167 if (err == 0 && rv == 0 && 1168 (sc->sc_stat & TPM_STS_DATA_AVAIL) != 0) { 1169 #ifdef TPM_DEBUG 1170 printf("tpm_tis12_end: read failed stat=%b\n", 1171 sc->sc_stat, TPM_STS_BITS); 1172 #endif 1173 rv = EIO; 1174 } 1175 tpm_tis12_abort(sc); 1176 } else { 1177 if (!sc->sc_locality) { 1178 tpm_tis12_abort(sc); 1179 return (err != 0 ? 0 : EIO); 1180 } 1181 /* Hungry for more? */ 1182 sc->sc_stat = tpm_status(sc); 1183 if (!err && (sc->sc_stat & TPM_STS_DATA_EXPECT)) { 1184 #ifdef TPM_DEBUG 1185 printf("tpm_tis12_end: write failed stat=%b\n", 1186 sc->sc_stat, TPM_STS_BITS); 1187 #endif 1188 rv = EIO; 1189 } 1190 1191 if (err != 0 || rv != 0) 1192 tpm_tis12_abort(sc); 1193 else { 1194 bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, 1195 TPM_STS_GO); 1196 sc->sc_command_pending = true; 1197 } 1198 } 1199 1200 return rv; 1201 } 1202 1203 void 1204 tpm_intr(void *v) 1205 { 1206 struct tpm_softc *sc = v; 1207 u_int32_t r; 1208 #ifdef TPM_DEBUG 1209 static int cnt = 0; 1210 #endif 1211 1212 mtx_lock(&sc->sc_intr_lock); 1213 r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS); 1214 #ifdef TPM_DEBUG 1215 if (r != 0) 1216 printf("tpm_intr: int=%b (%d)\n", r, TPM_INTERRUPT_ENABLE_BITS, 1217 cnt); 1218 else 1219 cnt++; 1220 #endif 1221 if (!(r & (TPM_CMD_READY_INT | TPM_LOCALITY_CHANGE_INT | 1222 TPM_STS_VALID_INT | TPM_DATA_AVAIL_INT))) { 1223 mtx_unlock(&sc->sc_intr_lock); 1224 return; 1225 } 1226 1227 bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS, r); 1228 cv_broadcast(&sc->sc_intr_cv); 1229 mtx_unlock(&sc->sc_intr_lock); 1230 1231 return; 1232 } 1233 1234 /* Read single byte using legacy interface. */ 1235 static inline u_int8_t 1236 tpm_legacy_in(bus_space_tag_t iot, bus_space_handle_t ioh, int reg) 1237 { 1238 bus_space_write_1(iot, ioh, 0, reg); 1239 return bus_space_read_1(iot, ioh, 1); 1240 } 1241 1242 #if 0 1243 /* Write single byte using legacy interface. */ 1244 static inline void 1245 tpm_legacy_out(bus_space_tag_t iot, bus_space_handle_t ioh, int reg, u_int8_t v) 1246 { 1247 bus_space_write_1(iot, ioh, 0, reg); 1248 bus_space_write_1(iot, ioh, 1, v); 1249 } 1250 #endif 1251 1252 /* Probe for TPM using legacy interface. */ 1253 int 1254 tpm_legacy_probe(bus_space_tag_t iot, bus_addr_t iobase) 1255 { 1256 bus_space_handle_t ioh; 1257 u_int8_t r, v; 1258 int i, rv = 0; 1259 char id[8]; 1260 1261 if (!tpm_enabled || iobase == -1) 1262 return 0; 1263 1264 if (bus_space_map(iot, iobase, 2, 0, &ioh)) 1265 return 0; 1266 1267 v = bus_space_read_1(iot, ioh, 0); 1268 if (v == 0xff) { 1269 bus_space_unmap(iot, ioh, 2); 1270 return 0; 1271 } 1272 r = bus_space_read_1(iot, ioh, 1); 1273 1274 for (i = sizeof(id); i--; ) 1275 id[i] = tpm_legacy_in(iot, ioh, TPM_ID + i); 1276 1277 #ifdef TPM_DEBUG 1278 printf("tpm_legacy_probe %.4s %d.%d.%d.%d\n", 1279 &id[4], id[0], id[1], id[2], id[3]); 1280 #endif 1281 /* 1282 * The only chips using the legacy interface we are aware of are 1283 * by Atmel. For other chips more signature would have to be added. 1284 */ 1285 if (!bcmp(&id[4], "ATML", 4)) 1286 rv = 1; 1287 1288 if (!rv) { 1289 bus_space_write_1(iot, ioh, r, 1); 1290 bus_space_write_1(iot, ioh, v, 0); 1291 } 1292 bus_space_unmap(iot, ioh, 2); 1293 1294 return rv; 1295 } 1296 1297 /* Setup TPM using legacy interface. */ 1298 int 1299 tpm_legacy_init(struct tpm_softc *sc, int irq, const char *name) 1300 { 1301 char id[8]; 1302 int i; 1303 1304 sx_assert(&sc->sc_lock, SA_XLOCKED); 1305 if ((i = bus_space_map(sc->sc_batm, tpm_enabled, 2, 0, &sc->sc_bahm))) { 1306 printf(": cannot map tpm registers (%d)\n", i); 1307 tpm_enabled = 0; 1308 return 1; 1309 } 1310 1311 for (i = sizeof(id); i--; ) 1312 id[i] = tpm_legacy_in(sc->sc_bt, sc->sc_bh, TPM_ID + i); 1313 1314 printf(": %.4s %d.%d @0x%x\n", &id[4], id[0], id[1], tpm_enabled); 1315 tpm_enabled = 0; 1316 1317 return 0; 1318 } 1319 1320 /* Start transaction. */ 1321 int 1322 tpm_legacy_start(struct tpm_softc *sc, int flag) 1323 { 1324 struct timeval tv; 1325 u_int8_t bits, r; 1326 int to, rv; 1327 1328 sx_assert(&sc->sc_lock, SA_XLOCKED); 1329 bits = flag == UIO_READ ? TPM_LEGACY_DA : 0; 1330 tv.tv_sec = TPM_LEGACY_TMO; 1331 tv.tv_usec = 0; 1332 to = tvtohz(&tv) / TPM_LEGACY_SLEEP; 1333 while (((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) & 1334 (TPM_LEGACY_BUSY|bits)) != bits && to--) { 1335 rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_start", 1336 TPM_LEGACY_SLEEP); 1337 if (rv && rv != EWOULDBLOCK) 1338 return rv; 1339 } 1340 1341 if ((r & (TPM_LEGACY_BUSY|bits)) != bits) 1342 return EIO; 1343 1344 return 0; 1345 } 1346 1347 int 1348 tpm_legacy_read(struct tpm_softc *sc, void *buf, int len, size_t *count, 1349 int flags) 1350 { 1351 u_int8_t *p; 1352 size_t cnt; 1353 int to, rv; 1354 1355 sx_assert(&sc->sc_lock, SA_XLOCKED); 1356 cnt = rv = 0; 1357 for (p = buf; !rv && len > 0; len--) { 1358 for (to = 1000; 1359 !(bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1) & 1360 TPM_LEGACY_DA); DELAY(1)) 1361 if (!to--) 1362 return EIO; 1363 1364 DELAY(TPM_LEGACY_DELAY); 1365 *p++ = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 0); 1366 cnt++; 1367 } 1368 1369 *count = cnt; 1370 return 0; 1371 } 1372 1373 int 1374 tpm_legacy_write(struct tpm_softc *sc, void *buf, int len) 1375 { 1376 u_int8_t *p; 1377 int n; 1378 1379 sx_assert(&sc->sc_lock, SA_XLOCKED); 1380 for (p = buf, n = len; n--; DELAY(TPM_LEGACY_DELAY)) { 1381 if (!n && len != TPM_BUFSIZ) { 1382 bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1, 1383 TPM_LEGACY_LAST); 1384 DELAY(TPM_LEGACY_DELAY); 1385 } 1386 bus_space_write_1(sc->sc_batm, sc->sc_bahm, 0, *p++); 1387 } 1388 1389 return 0; 1390 } 1391 1392 /* Finish transaction. */ 1393 int 1394 tpm_legacy_end(struct tpm_softc *sc, int flag, int rv) 1395 { 1396 struct timeval tv; 1397 u_int8_t r; 1398 int to; 1399 1400 sx_assert(&sc->sc_lock, SA_XLOCKED); 1401 if (rv || flag == UIO_READ) 1402 bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1, TPM_LEGACY_ABRT); 1403 else { 1404 tv.tv_sec = TPM_LEGACY_TMO; 1405 tv.tv_usec = 0; 1406 to = tvtohz(&tv) / TPM_LEGACY_SLEEP; 1407 while(((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) & 1408 TPM_LEGACY_BUSY) && to--) { 1409 rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_end", 1410 TPM_LEGACY_SLEEP); 1411 if (rv && rv != EWOULDBLOCK) 1412 return rv; 1413 } 1414 1415 if (r & TPM_LEGACY_BUSY) 1416 return EIO; 1417 1418 if (r & TPM_LEGACY_RE) 1419 return EIO; /* XXX Retry the loop? */ 1420 } 1421 1422 return rv; 1423 } 1424 1425 int 1426 tpmopen(struct cdev *dev, int flag, int mode, struct thread *td) 1427 { 1428 struct tpm_softc *sc; 1429 int error; 1430 1431 sc = TPMSOFTC(dev); 1432 if (sc == NULL) 1433 return (ENXIO); 1434 1435 sx_xlock(&sc->sc_lock); 1436 if (sc->sc_dying) 1437 error = ENXIO; 1438 else if (sc->sc_suspend != 0 || (sc->sc_flags & TPM_OPEN) != 0) 1439 error = EBUSY; 1440 else { 1441 sc->sc_flags |= TPM_OPEN; 1442 error = 0; 1443 } 1444 sx_xunlock(&sc->sc_lock); 1445 1446 return (error); 1447 } 1448 1449 int 1450 tpmclose(struct cdev *dev, int flag, int mode, struct thread *td) 1451 { 1452 struct tpm_softc *sc; 1453 int error; 1454 1455 sc = TPMSOFTC(dev); 1456 if (sc == NULL) 1457 return (ENXIO); 1458 1459 sx_xlock(&sc->sc_lock); 1460 if ((sc->sc_flags & TPM_OPEN) == 0) 1461 error = EINVAL; 1462 else { 1463 if (sc->sc_init == tpm_tis12_init) 1464 tpm_tis12_abort(sc); 1465 sc->sc_flags &= ~TPM_OPEN; 1466 error = 0; 1467 } 1468 sx_xunlock(&sc->sc_lock); 1469 1470 return (error); 1471 } 1472 1473 int 1474 tpmread(struct cdev *dev, struct uio *uio, int flags) 1475 { 1476 struct tpm_softc *sc; 1477 u_int8_t header[TPM_HDRSIZE], *buf; 1478 size_t cnt, len; 1479 int end_error, rv; 1480 1481 sc = TPMSOFTC(dev); 1482 if (sc == NULL) 1483 return (ENXIO); 1484 buf = NULL; 1485 1486 sx_xlock(&sc->sc_lock); 1487 if (sc->sc_dying) { 1488 rv = ENXIO; 1489 goto out; 1490 } 1491 if (sc->sc_suspend != 0) { 1492 rv = EBUSY; 1493 goto out; 1494 } 1495 rv = sc->sc_start(sc, UIO_READ); 1496 if (rv != 0) 1497 goto out; 1498 1499 #ifdef TPM_DEBUG 1500 printf("tpmread: getting header\n"); 1501 #endif 1502 rv = sc->sc_read(sc, header, sizeof(header), &cnt, 1503 TPM_PARAM_SIZE); 1504 if (rv != 0) 1505 goto end; 1506 if (cnt != sizeof(header)) { 1507 rv = EIO; 1508 goto end; 1509 } 1510 1511 len = be32dec(header + 2); 1512 #ifdef TPM_DEBUG 1513 printf("tpmread: len %zu, io count %zd\n", len, uio->uio_resid); 1514 #endif 1515 if (len < sizeof(header) || len > uio->uio_resid || len > INT_MAX) { 1516 rv = EIO; 1517 #ifdef TPM_DEBUG 1518 printf("tpmread: invalid response length %zu\n", len); 1519 #endif 1520 goto end; 1521 } 1522 1523 /* 1524 * Finish the device transaction before touching user memory. Use a 1525 * non-blocking allocation so lifecycle operations are not held up by 1526 * memory pressure while waiting for the transaction lock. 1527 */ 1528 buf = malloc(len, M_TPM, M_NOWAIT); 1529 if (buf == NULL) { 1530 rv = ENOMEM; 1531 goto end; 1532 } 1533 memcpy(buf, header, sizeof(header)); 1534 1535 if (len > sizeof(header)) { 1536 rv = sc->sc_read(sc, buf + sizeof(header), 1537 (int)(len - sizeof(header)), NULL, TPM_PARAM_SIZE); 1538 if (rv != 0) 1539 goto end; 1540 } 1541 1542 end: 1543 end_error = sc->sc_end(sc, UIO_READ, rv); 1544 if (rv == 0) 1545 rv = end_error; 1546 out: 1547 sx_xunlock(&sc->sc_lock); 1548 if (rv == 0) 1549 rv = uiomove(buf, (int)len, uio); 1550 free(buf, M_TPM); 1551 return (rv); 1552 } 1553 1554 int 1555 tpmwrite(struct cdev *dev, struct uio *uio, int flags) 1556 { 1557 struct tpm_softc *sc; 1558 u_int8_t buf[TPM_BUFSIZ]; 1559 ssize_t resid; 1560 int end_error, n, rv; 1561 1562 sc = TPMSOFTC(dev); 1563 if (sc == NULL) 1564 return (ENXIO); 1565 1566 resid = uio->uio_resid; 1567 n = MIN(sizeof(buf), resid); 1568 rv = uiomove(buf, n, uio); 1569 if (rv != 0) 1570 return (rv); 1571 1572 sx_xlock(&sc->sc_lock); 1573 if (sc->sc_dying) { 1574 rv = ENXIO; 1575 goto out; 1576 } 1577 if (sc->sc_suspend != 0) { 1578 rv = EBUSY; 1579 goto out; 1580 } 1581 1582 #ifdef TPM_DEBUG 1583 printf("tpmwrite: io count %d\n", n); 1584 #endif 1585 1586 rv = sc->sc_start(sc, UIO_WRITE); 1587 if (rv != 0) 1588 goto out; 1589 1590 rv = sc->sc_write(sc, buf, n); 1591 end_error = sc->sc_end(sc, UIO_WRITE, rv); 1592 if (rv == 0) 1593 rv = end_error; 1594 1595 out: 1596 sx_xunlock(&sc->sc_lock); 1597 if (rv != 0) 1598 uio->uio_resid = resid; 1599 return (rv); 1600 } 1601 1602 int 1603 tpmioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags, 1604 struct thread *td) 1605 { 1606 return ENOTTY; 1607 } 1608