1 /*- 2 * Copyright (c) 2018 Stormshield. 3 * Copyright (c) 2018 Semihalf. 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 18 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, 19 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 20 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 21 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 23 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 24 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 #include "tpm20.h" 30 #include "tpm_if.h" 31 32 /* 33 * TIS register space as defined in 34 * TCG_PC_Client_Platform_TPM_Profile_PTP_2.0_r1.03_v22 35 */ 36 #define TPM_ACCESS 0x0 37 #define TPM_INT_ENABLE 0x8 38 #define TPM_INT_VECTOR 0xc 39 #define TPM_INT_STS 0x10 40 #define TPM_INTF_CAPS 0x14 41 #define TPM_STS 0x18 42 #define TPM_DATA_FIFO 0x24 43 #define TPM_INTF_ID 0x30 44 #define TPM_XDATA_FIFO 0x80 45 #define TPM_DID_VID 0xF00 46 #define TPM_RID 0xF04 47 48 #define TPM_ACCESS_LOC_REQ BIT(1) 49 #define TPM_ACCESS_LOC_Seize BIT(3) 50 #define TPM_ACCESS_LOC_ACTIVE BIT(5) 51 #define TPM_ACCESS_LOC_RELINQUISH BIT(5) 52 #define TPM_ACCESS_VALID BIT(7) 53 54 #define TPM_INT_ENABLE_GLOBAL_ENABLE BIT(31) 55 #define TPM_INT_ENABLE_CMD_RDY BIT(7) 56 #define TPM_INT_ENABLE_LOC_CHANGE BIT(2) 57 #define TPM_INT_ENABLE_STS_VALID BIT(1) 58 #define TPM_INT_ENABLE_DATA_AVAIL BIT(0) 59 60 #define TPM_INT_STS_CMD_RDY BIT(7) 61 #define TPM_INT_STS_LOC_CHANGE BIT(2) 62 #define TPM_INT_STS_VALID BIT(1) 63 #define TPM_INT_STS_DATA_AVAIL BIT(0) 64 65 #define TPM_INTF_CAPS_VERSION 0x70000000 66 #define TPM_INTF_CAPS_TPM20 0x30000000 67 68 #define TPM_STS_VALID BIT(7) 69 #define TPM_STS_CMD_RDY BIT(6) 70 #define TPM_STS_CMD_START BIT(5) 71 #define TPM_STS_DATA_AVAIL BIT(4) 72 #define TPM_STS_DATA_EXPECTED BIT(3) 73 #define TPM_STS_BURST_MASK 0xFFFF00 74 #define TPM_STS_BURST_OFFSET 0x8 75 76 static int tpmtis_transmit(device_t dev, struct tpm_priv *priv, size_t length); 77 78 static int tpmtis_detach(device_t dev); 79 80 static void tpmtis_intr_handler(void *arg); 81 82 static bool tpmtis_program_intr(struct tpm_sc *sc, bool enable); 83 static void tpmtis_setup_intr(struct tpm_sc *sc); 84 static int tpmtis_resume(device_t dev); 85 86 static bool tpmtis_read_bytes(struct tpm_sc *sc, size_t count, uint8_t *buf); 87 static bool tpmtis_write_bytes(struct tpm_sc *sc, size_t count, uint8_t *buf); 88 static bool tpmtis_request_locality(struct tpm_sc *sc, int locality); 89 static void tpmtis_relinquish_locality(struct tpm_sc *sc); 90 static bool tpmtis_go_ready(struct tpm_sc *sc); 91 92 static bool tpm_wait_for_reg(struct tpm_sc *sc, bus_size_t off, 93 uint32_t mask, uint32_t val, int32_t timeout, int intr_type, 94 bool reg32); 95 96 static uint16_t tpmtis_wait_for_burst(struct tpm_sc *sc); 97 98 int 99 tpmtis_attach(device_t dev) 100 { 101 struct tpm_sc *sc; 102 int result; 103 int poll = 0; 104 105 sc = device_get_softc(dev); 106 sc->dev = dev; 107 sc->intr_type = -1; 108 sc->intr_generation = 0; 109 110 sx_init(&sc->dev_lock, "TPM driver lock"); 111 mtx_init(&sc->intr_lock, "TPM interrupt lock", NULL, MTX_DEF); 112 cv_init(&sc->intr_cv, "tpmtis_intr"); 113 114 resource_int_value("tpm", device_get_unit(dev), "use_polling", &poll); 115 if (poll != 0) { 116 device_printf(dev, "Using poll method to get TPM operation status \n"); 117 goto skip_irq; 118 } 119 120 sc->irq_rid = 0; 121 sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid, 122 RF_ACTIVE | RF_SHAREABLE); 123 if (sc->irq_res == NULL) 124 goto skip_irq; 125 126 result = bus_setup_intr(dev, sc->irq_res, INTR_TYPE_MISC | INTR_MPSAFE, 127 NULL, tpmtis_intr_handler, sc, &sc->intr_cookie); 128 if (result != 0) { 129 if (bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, 130 sc->irq_res) == 0) 131 sc->irq_res = NULL; 132 goto skip_irq; 133 } 134 skip_irq: 135 result = tpm20_init(sc); 136 if (result != 0) { 137 tpmtis_detach(dev); 138 return (result); 139 } 140 tpmtis_setup_intr(sc); 141 142 return (0); 143 } 144 145 static int 146 tpmtis_detach(device_t dev) 147 { 148 struct tpm_sc *sc; 149 150 sc = device_get_softc(dev); 151 tpm20_release(sc); 152 153 if (sc->intr_cookie != NULL) 154 bus_teardown_intr(dev, sc->irq_res, sc->intr_cookie); 155 cv_destroy(&sc->intr_cv); 156 mtx_destroy(&sc->intr_lock); 157 158 if (sc->irq_res != NULL) 159 bus_release_resource(dev, SYS_RES_IRQ, 160 sc->irq_rid, sc->irq_res); 161 162 if (sc->mem_res != NULL) 163 bus_release_resource(dev, SYS_RES_MEMORY, 164 sc->mem_rid, sc->mem_res); 165 166 return (0); 167 } 168 169 /* 170 * Test if the advertisted interrupt actually works. 171 * This sends a simple command. (GetRandom) 172 * Interrupts are then enabled in the handler. 173 */ 174 static void 175 tpmtis_test_intr(struct tpm_sc *sc) 176 { 177 struct tpm_priv *priv; 178 uint8_t cmd[] = { 179 0x80, 0x01, /* TPM_ST_NO_SESSIONS tag*/ 180 0x00, 0x00, 0x00, 0x0c, /* cmd length */ 181 0x00, 0x00, 0x01, 0x7b, /* cmd TPM_CC_GetRandom */ 182 0x00, 0x01 /* number of bytes requested */ 183 }; 184 185 sx_xlock(&sc->dev_lock); 186 priv = sc->internal_priv; 187 memcpy(priv->buf, cmd, sizeof(cmd)); 188 tpmtis_transmit(sc->dev, priv, sizeof(cmd)); 189 sx_xunlock(&sc->dev_lock); 190 } 191 192 static bool 193 tpmtis_program_intr(struct tpm_sc *sc, bool enable) 194 { 195 rman_res_t irq; 196 uint32_t reg; 197 198 sx_assert(&sc->dev_lock, SA_XLOCKED); 199 200 if (enable) { 201 irq = bus_get_resource_start(sc->dev, SYS_RES_IRQ, 202 sc->irq_rid); 203 204 /* 205 * SIRQ has to be between 1 - 15. A system reporting 0x2d 206 * produced an interrupt storm when that value was used. 207 */ 208 if (irq == 0 || irq > 0xF) 209 return (false); 210 } 211 212 if (!tpmtis_request_locality(sc, 0)) 213 return (false); 214 215 /* Disable delivery before acknowledging or reconfiguring interrupts. */ 216 reg = TPM_READ_4(sc->dev, TPM_INT_ENABLE); 217 reg &= ~TPM_INT_ENABLE_GLOBAL_ENABLE; 218 TPM_WRITE_4(sc->dev, TPM_INT_ENABLE, reg); 219 220 /* Clear all pending interrupts. */ 221 reg = TPM_READ_4(sc->dev, TPM_INT_STS); 222 TPM_WRITE_4(sc->dev, TPM_INT_STS, reg); 223 224 if (enable) { 225 TPM_WRITE_1(sc->dev, TPM_INT_VECTOR, (uint8_t)irq); 226 227 if (sc->intr_mask == 0) { 228 reg = TPM_READ_4(sc->dev, TPM_INT_ENABLE); 229 reg |= TPM_INT_ENABLE_DATA_AVAIL | 230 TPM_INT_ENABLE_LOC_CHANGE | 231 TPM_INT_ENABLE_CMD_RDY | 232 TPM_INT_ENABLE_STS_VALID; 233 reg &= ~TPM_INT_ENABLE_GLOBAL_ENABLE; 234 sc->intr_mask = reg; 235 } 236 TPM_WRITE_4(sc->dev, TPM_INT_ENABLE, 237 sc->intr_mask | TPM_INT_ENABLE_GLOBAL_ENABLE); 238 } 239 240 tpmtis_relinquish_locality(sc); 241 return (true); 242 } 243 244 static void 245 tpmtis_setup_intr(struct tpm_sc *sc) 246 { 247 bool configured, enable; 248 249 enable = sc->intr_cookie != NULL; 250 sx_xlock(&sc->dev_lock); 251 mtx_lock(&sc->intr_lock); 252 sc->interrupts = false; 253 sc->intr_type = -1; 254 mtx_unlock(&sc->intr_lock); 255 configured = tpmtis_program_intr(sc, enable); 256 sx_xunlock(&sc->dev_lock); 257 if (!configured || !enable) 258 return; 259 tpmtis_test_intr(sc); 260 } 261 262 static int 263 tpmtis_resume(device_t dev) 264 { 265 struct tpm_sc *sc; 266 bool restore_intr; 267 268 sc = device_get_softc(dev); 269 sx_xlock(&sc->dev_lock); 270 mtx_lock(&sc->intr_lock); 271 restore_intr = sc->interrupts; 272 273 /* 274 * Interrupt routing and enable state may be lost across suspend. Keep 275 * the transport in polling mode until a restored interrupt is actually 276 * observed by the handler. 277 */ 278 sc->interrupts = false; 279 sc->intr_type = -1; 280 mtx_unlock(&sc->intr_lock); 281 if (!tpmtis_program_intr(sc, restore_intr)) 282 device_printf(dev, 283 "failed to %s interrupts; using polling\n", 284 restore_intr ? "restore" : "disable"); 285 sx_xunlock(&sc->dev_lock); 286 287 return (tpm20_resume(dev)); 288 } 289 290 static void 291 tpmtis_intr_handler(void *arg) 292 { 293 struct tpm_sc *sc; 294 uint32_t status; 295 296 sc = (struct tpm_sc *)arg; 297 status = TPM_READ_4(sc->dev, TPM_INT_STS); 298 299 TPM_WRITE_4(sc->dev, TPM_INT_STS, status); 300 301 mtx_lock(&sc->intr_lock); 302 /* Check for stray interrupts. */ 303 if (sc->intr_type != -1 && (sc->intr_type & status) != 0) { 304 sc->interrupts = true; 305 sc->intr_generation++; 306 cv_broadcast(&sc->intr_cv); 307 } 308 mtx_unlock(&sc->intr_lock); 309 } 310 311 static uint32_t 312 tpmtis_read_wait_reg(struct tpm_sc *sc, bus_size_t off, bool reg32) 313 { 314 315 if (reg32) 316 return (TPM_READ_4(sc->dev, off)); 317 return (TPM_READ_1(sc->dev, off)); 318 } 319 320 static bool 321 tpm_wait_for_reg(struct tpm_sc *sc, bus_size_t off, uint32_t mask, 322 uint32_t val, int32_t timeout, int intr_type, bool reg32) 323 { 324 sbintime_t deadline; 325 uint32_t generation; 326 bool interrupts, result; 327 328 sx_assert(&sc->dev_lock, SA_XLOCKED); 329 deadline = sbinuptime() + ustosbt(timeout); 330 mtx_lock(&sc->intr_lock); 331 sc->intr_type = intr_type; 332 generation = sc->intr_generation; 333 interrupts = sc->interrupts; 334 mtx_unlock(&sc->intr_lock); 335 336 for (;;) { 337 result = (tpmtis_read_wait_reg(sc, off, reg32) & mask) == val; 338 if (result) 339 break; 340 if (sbinuptime() >= deadline) 341 break; 342 if (!interrupts) { 343 pause("TPM POLLING", 1); 344 mtx_lock(&sc->intr_lock); 345 generation = sc->intr_generation; 346 interrupts = sc->interrupts; 347 mtx_unlock(&sc->intr_lock); 348 continue; 349 } 350 351 /* 352 * Register access may sleep for a SPI TPM, so evaluate the 353 * predicate without intr_lock. The generation check closes the 354 * resulting window before cv_timedwait_sbt() atomically sleeps. 355 */ 356 mtx_lock(&sc->intr_lock); 357 if (generation == sc->intr_generation) 358 (void)cv_timedwait_sbt(&sc->intr_cv, &sc->intr_lock, 359 deadline, 0, C_ABSOLUTE | C_HARDCLOCK); 360 generation = sc->intr_generation; 361 interrupts = sc->interrupts; 362 mtx_unlock(&sc->intr_lock); 363 } 364 365 mtx_lock(&sc->intr_lock); 366 sc->intr_type = -1; 367 mtx_unlock(&sc->intr_lock); 368 return (result); 369 } 370 371 static uint16_t 372 tpmtis_wait_for_burst(struct tpm_sc *sc) 373 { 374 int timeout; 375 uint16_t burst_count; 376 377 timeout = TPM_TIMEOUT_A; 378 379 while (timeout-- > 0) { 380 burst_count = (TPM_READ_4(sc->dev, TPM_STS) & TPM_STS_BURST_MASK) >> 381 TPM_STS_BURST_OFFSET; 382 if (burst_count > 0) 383 break; 384 385 DELAY(1); 386 } 387 return (burst_count); 388 } 389 390 static bool 391 tpmtis_read_bytes(struct tpm_sc *sc, size_t count, uint8_t *buf) 392 { 393 uint16_t burst_count; 394 395 while (count > 0) { 396 burst_count = tpmtis_wait_for_burst(sc); 397 if (burst_count == 0) 398 return (false); 399 400 burst_count = MIN(burst_count, count); 401 count -= burst_count; 402 403 while (burst_count-- > 0) 404 *buf++ = TPM_READ_1(sc->dev, TPM_DATA_FIFO); 405 } 406 407 return (true); 408 } 409 410 static bool 411 tpmtis_write_bytes(struct tpm_sc *sc, size_t count, uint8_t *buf) 412 { 413 uint16_t burst_count; 414 415 while (count > 0) { 416 burst_count = tpmtis_wait_for_burst(sc); 417 if (burst_count == 0) 418 return (false); 419 420 burst_count = MIN(burst_count, count); 421 count -= burst_count; 422 423 while (burst_count-- > 0) 424 TPM_WRITE_1(sc->dev, TPM_DATA_FIFO, *buf++); 425 } 426 427 return (true); 428 } 429 430 static bool 431 tpmtis_request_locality(struct tpm_sc *sc, int locality) 432 { 433 uint8_t mask; 434 435 sx_assert(&sc->dev_lock, SA_XLOCKED); 436 /* Currently we only support Locality 0 */ 437 if (locality != 0) 438 return (false); 439 440 mask = TPM_ACCESS_LOC_ACTIVE | TPM_ACCESS_VALID; 441 442 TPM_WRITE_1(sc->dev, TPM_ACCESS, TPM_ACCESS_LOC_REQ); 443 TPM_WRITE_BARRIER(sc->dev, TPM_ACCESS, 1); 444 return (tpm_wait_for_reg(sc, TPM_ACCESS, mask, mask, TPM_TIMEOUT_A, 445 TPM_INT_STS_LOC_CHANGE, false)); 446 } 447 448 static void 449 tpmtis_relinquish_locality(struct tpm_sc *sc) 450 { 451 bool interrupts; 452 453 sx_assert(&sc->dev_lock, SA_XLOCKED); 454 /* 455 * Interrupts can only be cleared when a locality is active. 456 * Clear them now in case interrupt handler didn't make it in time. 457 */ 458 mtx_lock(&sc->intr_lock); 459 interrupts = sc->interrupts; 460 mtx_unlock(&sc->intr_lock); 461 if (interrupts) 462 TPM_WRITE_4(sc->dev, TPM_INT_STS, 463 TPM_READ_4(sc->dev, TPM_INT_STS)); 464 465 OR1(sc, TPM_ACCESS, TPM_ACCESS_LOC_RELINQUISH); 466 } 467 468 static bool 469 tpmtis_go_ready(struct tpm_sc *sc) 470 { 471 uint32_t mask; 472 473 mask = TPM_STS_CMD_RDY; 474 475 TPM_WRITE_4(sc->dev, TPM_STS, TPM_STS_CMD_RDY); 476 TPM_WRITE_BARRIER(sc->dev, TPM_STS, 4); 477 if (!tpm_wait_for_reg(sc, TPM_STS, mask, mask, TPM_TIMEOUT_B, 478 TPM_INT_STS_CMD_RDY, true)) 479 return (false); 480 481 return (true); 482 } 483 484 static int 485 tpmtis_transmit(device_t dev, struct tpm_priv *priv, size_t length) 486 { 487 struct tpm_sc *sc; 488 size_t bytes_available; 489 uint32_t mask, curr_cmd; 490 int error, timeout; 491 bool locality; 492 493 sc = device_get_softc(dev); 494 sx_assert(&sc->dev_lock, SA_XLOCKED); 495 locality = false; 496 497 if (!tpmtis_request_locality(sc, 0)) { 498 device_printf(dev, 499 "Failed to obtain locality\n"); 500 return (EIO); 501 } 502 locality = true; 503 if (!tpmtis_go_ready(sc)) { 504 device_printf(dev, 505 "Failed to switch to ready state\n"); 506 error = EIO; 507 goto out; 508 } 509 if (!tpmtis_write_bytes(sc, length, priv->buf)) { 510 device_printf(dev, 511 "Failed to write cmd to device\n"); 512 error = EIO; 513 goto out; 514 } 515 516 mask = TPM_STS_VALID; 517 if (!tpm_wait_for_reg(sc, TPM_STS, mask, mask, TPM_TIMEOUT_C, 518 TPM_INT_STS_VALID, true)) { 519 device_printf(dev, 520 "Timeout while waiting for valid bit\n"); 521 error = EIO; 522 goto out; 523 } 524 if (TPM_READ_4(dev, TPM_STS) & TPM_STS_DATA_EXPECTED) { 525 device_printf(dev, 526 "Device expects more data even though we already" 527 " sent everything we had\n"); 528 error = EIO; 529 goto out; 530 } 531 532 /* 533 * Calculate timeout for current command. 534 * Command code is passed in bytes 6-10. 535 */ 536 curr_cmd = be32toh(*(uint32_t *) (&priv->buf[6])); 537 timeout = tpm20_get_timeout(curr_cmd); 538 539 TPM_WRITE_4(dev, TPM_STS, TPM_STS_CMD_START); 540 TPM_WRITE_BARRIER(dev, TPM_STS, 4); 541 542 mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID; 543 if (!tpm_wait_for_reg(sc, TPM_STS, mask, mask, timeout, 544 TPM_INT_STS_DATA_AVAIL, true)) { 545 device_printf(dev, 546 "Timeout while waiting for device to process cmd\n"); 547 /* 548 * Switching to ready state also cancels processing 549 * current command 550 */ 551 if (!tpmtis_go_ready(sc)) { 552 error = EIO; 553 goto out; 554 } 555 556 /* 557 * After canceling a command we should get a response, 558 * check if there is one. 559 */ 560 if (!tpm_wait_for_reg(sc, TPM_STS, mask, mask, TPM_TIMEOUT_C, 561 TPM_INT_STS_DATA_AVAIL, true)) { 562 error = EIO; 563 goto out; 564 } 565 } 566 /* Read response header. Length is passed in bytes 2 - 6. */ 567 if (!tpmtis_read_bytes(sc, TPM_HEADER_SIZE, priv->buf)) { 568 device_printf(dev, 569 "Failed to read response header\n"); 570 error = EIO; 571 goto out; 572 } 573 bytes_available = be32toh(*(uint32_t *) (&priv->buf[2])); 574 575 if (bytes_available > TPM_BUFSIZE || bytes_available < TPM_HEADER_SIZE) { 576 device_printf(dev, 577 "Incorrect response size: %zu\n", 578 bytes_available); 579 error = EIO; 580 goto out; 581 } 582 if (!tpmtis_read_bytes(sc, bytes_available - TPM_HEADER_SIZE, 583 &priv->buf[TPM_HEADER_SIZE])) { 584 device_printf(dev, 585 "Failed to read response\n"); 586 error = EIO; 587 goto out; 588 } 589 priv->offset = 0; 590 priv->len = bytes_available; 591 error = 0; 592 593 out: 594 /* 595 * Per TIS 1.3 section 5.6.12, write commandReady after every command 596 * attempt so the TPM can discard a partial FIFO transaction and free 597 * its internal resources. The next tpmtis_go_ready() provides the 598 * second write the spec mentions and waits for the state transition. 599 */ 600 if (locality) { 601 TPM_WRITE_4(sc->dev, TPM_STS, TPM_STS_CMD_RDY); 602 TPM_WRITE_BARRIER(sc->dev, TPM_STS, 4); 603 tpmtis_relinquish_locality(sc); 604 } 605 606 return (error); 607 } 608 609 /* ACPI Driver */ 610 static device_method_t tpmtis_methods[] = { 611 DEVMETHOD(device_attach, tpmtis_attach), 612 DEVMETHOD(device_detach, tpmtis_detach), 613 DEVMETHOD(device_shutdown, tpm20_shutdown), 614 DEVMETHOD(device_suspend, tpm20_suspend), 615 DEVMETHOD(device_resume, tpmtis_resume), 616 DEVMETHOD(tpm_transmit, tpmtis_transmit), 617 DEVMETHOD_END 618 }; 619 620 DEFINE_CLASS_0(tpmtis, tpmtis_driver, tpmtis_methods, sizeof(struct tpm_sc)); 621