1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2014 Intel Corporation 4 * 5 * Authors: 6 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> 7 * 8 * Maintained by: <tpmdd-devel@lists.sourceforge.net> 9 * 10 * This device driver implements the TPM interface as defined in 11 * the TCG CRB 2.0 TPM specification. 12 */ 13 14 #include <linux/acpi.h> 15 #include <linux/highmem.h> 16 #include <linux/rculist.h> 17 #include <linux/module.h> 18 #include <linux/platform_device.h> 19 #include <linux/pm_runtime.h> 20 #ifdef CONFIG_ARM64 21 #include <linux/arm-smccc.h> 22 #endif 23 #include "tpm_crb_ffa.h" 24 #include "tpm.h" 25 26 #define ACPI_SIG_TPM2 "TPM2" 27 #define TPM_CRB_MAX_RESOURCES 3 28 29 static const guid_t crb_acpi_start_guid = 30 GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714, 31 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4); 32 33 enum crb_defaults { 34 CRB_ACPI_START_REVISION_ID = 1, 35 CRB_ACPI_START_INDEX = 1, 36 }; 37 38 enum crb_loc_ctrl { 39 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0), 40 CRB_LOC_CTRL_RELINQUISH = BIT(1), 41 }; 42 43 enum crb_loc_state { 44 CRB_LOC_STATE_LOC_ASSIGNED = BIT(1), 45 CRB_LOC_STATE_TPM_REG_VALID_STS = BIT(7), 46 }; 47 48 enum crb_ctrl_req { 49 CRB_CTRL_REQ_CMD_READY = BIT(0), 50 CRB_CTRL_REQ_GO_IDLE = BIT(1), 51 }; 52 53 enum crb_ctrl_sts { 54 CRB_CTRL_STS_ERROR = BIT(0), 55 CRB_CTRL_STS_TPM_IDLE = BIT(1), 56 }; 57 58 enum crb_start { 59 CRB_START_INVOKE = BIT(0), 60 }; 61 62 enum crb_cancel { 63 CRB_CANCEL_INVOKE = BIT(0), 64 }; 65 66 struct crb_regs_head { 67 u32 loc_state; 68 u32 reserved1; 69 u32 loc_ctrl; 70 u32 loc_sts; 71 u8 reserved2[32]; 72 u64 intf_id; 73 u64 ctrl_ext; 74 } __packed; 75 76 struct crb_regs_tail { 77 u32 ctrl_req; 78 u32 ctrl_sts; 79 u32 ctrl_cancel; 80 u32 ctrl_start; 81 u32 ctrl_int_enable; 82 u32 ctrl_int_sts; 83 u32 ctrl_cmd_size; 84 u32 ctrl_cmd_pa_low; 85 u32 ctrl_cmd_pa_high; 86 u32 ctrl_rsp_size; 87 u64 ctrl_rsp_pa; 88 } __packed; 89 90 enum crb_status { 91 CRB_DRV_STS_COMPLETE = BIT(0), 92 }; 93 94 struct crb_priv { 95 u32 sm; 96 const char *hid; 97 struct crb_regs_head __iomem *regs_h; 98 struct crb_regs_tail __iomem *regs_t; 99 u8 __iomem *cmd; 100 u8 __iomem *rsp; 101 u32 cmd_size; 102 u32 smc_func_id; 103 u32 __iomem *pluton_start_addr; 104 u32 __iomem *pluton_reply_addr; 105 u8 ffa_flags; 106 u8 ffa_attributes; 107 }; 108 109 struct tpm2_crb_smc { 110 u32 interrupt; 111 u8 interrupt_flags; 112 u8 op_flags; 113 u16 reserved2; 114 u32 smc_func_id; 115 }; 116 117 /* CRB over FFA start method parameters in TCG2 ACPI table */ 118 struct tpm2_crb_ffa { 119 u8 flags; 120 u8 attributes; 121 u16 partition_id; 122 u8 reserved[8]; 123 }; 124 125 struct tpm2_crb_pluton { 126 u64 start_addr; 127 u64 reply_addr; 128 }; 129 130 /* 131 * Returns true if the start method supports idle. 132 */ 133 static inline bool tpm_crb_has_idle(u32 start_method) 134 { 135 return !(start_method == ACPI_TPM2_START_METHOD || 136 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD || 137 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC); 138 } 139 140 static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, 141 unsigned long timeout) 142 { 143 ktime_t start; 144 ktime_t stop; 145 146 start = ktime_get(); 147 stop = ktime_add(start, ms_to_ktime(timeout)); 148 149 do { 150 if ((ioread32(reg) & mask) == value) 151 return true; 152 153 usleep_range(50, 100); 154 } while (ktime_before(ktime_get(), stop)); 155 156 return ((ioread32(reg) & mask) == value); 157 } 158 159 static int crb_try_pluton_doorbell(struct crb_priv *priv, bool wait_for_complete) 160 { 161 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) 162 return 0; 163 164 if (!crb_wait_for_reg_32(priv->pluton_reply_addr, ~0, 1, TPM2_TIMEOUT_C)) 165 return -ETIME; 166 167 iowrite32(1, priv->pluton_start_addr); 168 if (wait_for_complete == false) 169 return 0; 170 171 if (!crb_wait_for_reg_32(priv->pluton_start_addr, 172 0xffffffff, 0, 200)) 173 return -ETIME; 174 175 return 0; 176 } 177 178 /** 179 * __crb_go_idle - request tpm crb device to go the idle state 180 * 181 * @dev: crb device 182 * @priv: crb private data 183 * @loc: locality 184 * 185 * Write CRB_CTRL_REQ_GO_IDLE to TPM_CRB_CTRL_REQ 186 * The device should respond within TIMEOUT_C by clearing the bit. 187 * Anyhow, we do not wait here as a consequent CMD_READY request 188 * will be handled correctly even if idle was not completed. 189 * 190 * The function does nothing for devices with ACPI-start method 191 * or SMC-start method. 192 * 193 * Return: 0 always 194 */ 195 static int __crb_go_idle(struct device *dev, struct crb_priv *priv, int loc) 196 { 197 int rc; 198 199 if (!tpm_crb_has_idle(priv->sm)) 200 return 0; 201 202 iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req); 203 204 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 205 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc); 206 if (rc) 207 return rc; 208 } 209 210 rc = crb_try_pluton_doorbell(priv, true); 211 if (rc) 212 return rc; 213 214 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, 215 CRB_CTRL_REQ_GO_IDLE/* mask */, 216 0, /* value */ 217 TPM2_TIMEOUT_C)) { 218 dev_warn(dev, "goIdle timed out\n"); 219 return -ETIME; 220 } 221 222 return 0; 223 } 224 225 static int crb_go_idle(struct tpm_chip *chip) 226 { 227 struct device *dev = &chip->dev; 228 struct crb_priv *priv = dev_get_drvdata(dev); 229 230 return __crb_go_idle(dev, priv, chip->locality); 231 } 232 233 /** 234 * __crb_cmd_ready - request tpm crb device to enter ready state 235 * 236 * @dev: crb device 237 * @priv: crb private data 238 * @loc: locality 239 * 240 * Write CRB_CTRL_REQ_CMD_READY to TPM_CRB_CTRL_REQ 241 * and poll till the device acknowledge it by clearing the bit. 242 * The device should respond within TIMEOUT_C. 243 * 244 * The function does nothing for devices with ACPI-start method 245 * or SMC-start method. 246 * 247 * Return: 0 on success -ETIME on timeout; 248 */ 249 static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv, int loc) 250 { 251 int rc; 252 253 if (!tpm_crb_has_idle(priv->sm)) 254 return 0; 255 256 iowrite32(CRB_CTRL_REQ_CMD_READY, &priv->regs_t->ctrl_req); 257 258 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 259 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc); 260 if (rc) 261 return rc; 262 } 263 264 rc = crb_try_pluton_doorbell(priv, true); 265 if (rc) 266 return rc; 267 268 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, 269 CRB_CTRL_REQ_CMD_READY /* mask */, 270 0, /* value */ 271 TPM2_TIMEOUT_C)) { 272 dev_warn(dev, "cmdReady timed out\n"); 273 return -ETIME; 274 } 275 276 return 0; 277 } 278 279 static int crb_cmd_ready(struct tpm_chip *chip) 280 { 281 struct device *dev = &chip->dev; 282 struct crb_priv *priv = dev_get_drvdata(dev); 283 284 return __crb_cmd_ready(dev, priv, chip->locality); 285 } 286 287 static int __crb_request_locality(struct device *dev, 288 struct crb_priv *priv, int loc) 289 { 290 u32 value = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS; 291 int rc; 292 293 if (!priv->regs_h) 294 return 0; 295 296 iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl); 297 298 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 299 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc); 300 if (rc) 301 return rc; 302 } 303 304 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value, 305 TPM2_TIMEOUT_C)) { 306 dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n"); 307 return -ETIME; 308 } 309 310 return 0; 311 } 312 313 static int crb_request_locality(struct tpm_chip *chip, int loc) 314 { 315 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 316 317 return __crb_request_locality(&chip->dev, priv, loc); 318 } 319 320 static int __crb_relinquish_locality(struct device *dev, 321 struct crb_priv *priv, int loc) 322 { 323 u32 mask = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS; 324 u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS; 325 int rc; 326 327 if (!priv->regs_h) 328 return 0; 329 330 iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl); 331 332 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 333 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc); 334 if (rc) 335 return rc; 336 } 337 338 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value, 339 TPM2_TIMEOUT_C)) { 340 dev_warn(dev, "TPM_LOC_STATE_x.Relinquish timed out\n"); 341 return -ETIME; 342 } 343 344 return 0; 345 } 346 347 static int crb_relinquish_locality(struct tpm_chip *chip, int loc) 348 { 349 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 350 351 return __crb_relinquish_locality(&chip->dev, priv, loc); 352 } 353 354 static u8 crb_status(struct tpm_chip *chip) 355 { 356 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 357 u8 sts = 0; 358 359 if ((ioread32(&priv->regs_t->ctrl_start) & CRB_START_INVOKE) != 360 CRB_START_INVOKE) 361 sts |= CRB_DRV_STS_COMPLETE; 362 363 return sts; 364 } 365 366 static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) 367 { 368 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 369 unsigned int expected; 370 371 /* A sanity check that the upper layer wants to get at least the header 372 * as that is the minimum size for any TPM response. 373 */ 374 if (count < TPM_HEADER_SIZE) 375 return -EIO; 376 377 /* If this bit is set, according to the spec, the TPM is in 378 * unrecoverable condition. 379 */ 380 if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR) 381 return -EIO; 382 383 /* Read the first 8 bytes in order to get the length of the response. 384 * We read exactly a quad word in order to make sure that the remaining 385 * reads will be aligned. 386 */ 387 memcpy_fromio(buf, priv->rsp, 8); 388 389 expected = be32_to_cpup((__be32 *)&buf[2]); 390 if (expected > count || expected < TPM_HEADER_SIZE) 391 return -EIO; 392 393 memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8); 394 395 return expected; 396 } 397 398 static int crb_do_acpi_start(struct tpm_chip *chip) 399 { 400 union acpi_object *obj; 401 int rc; 402 403 obj = acpi_evaluate_dsm(chip->acpi_dev_handle, 404 &crb_acpi_start_guid, 405 CRB_ACPI_START_REVISION_ID, 406 CRB_ACPI_START_INDEX, 407 NULL); 408 if (!obj) 409 return -ENXIO; 410 rc = obj->integer.value == 0 ? 0 : -ENXIO; 411 ACPI_FREE(obj); 412 return rc; 413 } 414 415 #ifdef CONFIG_ARM64 416 /* 417 * This is a TPM Command Response Buffer start method that invokes a 418 * Secure Monitor Call to request the firmware to execute or cancel 419 * a TPM 2.0 command. 420 */ 421 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id) 422 { 423 struct arm_smccc_res res; 424 425 arm_smccc_smc(func_id, 0, 0, 0, 0, 0, 0, 0, &res); 426 if (res.a0 != 0) { 427 dev_err(dev, 428 FW_BUG "tpm_crb_smc_start() returns res.a0 = 0x%lx\n", 429 res.a0); 430 return -EIO; 431 } 432 433 return 0; 434 } 435 #else 436 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id) 437 { 438 dev_err(dev, FW_BUG "tpm_crb: incorrect start method\n"); 439 return -EINVAL; 440 } 441 #endif 442 443 static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len) 444 { 445 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 446 int rc = 0; 447 448 /* Zero the cancel register so that the next command will not get 449 * canceled. 450 */ 451 iowrite32(0, &priv->regs_t->ctrl_cancel); 452 453 if (len > priv->cmd_size) { 454 dev_err(&chip->dev, "invalid command count value %zd %d\n", 455 len, priv->cmd_size); 456 return -E2BIG; 457 } 458 459 /* Seems to be necessary for every command */ 460 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) 461 __crb_cmd_ready(&chip->dev, priv, chip->locality); 462 463 memcpy_toio(priv->cmd, buf, len); 464 465 /* Make sure that cmd is populated before issuing start. */ 466 wmb(); 467 468 /* The reason for the extra quirk is that the PTT in 4th Gen Core CPUs 469 * report only ACPI start but in practice seems to require both 470 * CRB start, hence invoking CRB start method if hid == MSFT0101. 471 */ 472 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER || 473 priv->sm == ACPI_TPM2_MEMORY_MAPPED || 474 !strcmp(priv->hid, "MSFT0101")) 475 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 476 477 if (priv->sm == ACPI_TPM2_START_METHOD || 478 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) 479 rc = crb_do_acpi_start(chip); 480 481 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) { 482 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 483 rc = tpm_crb_smc_start(&chip->dev, priv->smc_func_id); 484 } 485 486 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 487 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 488 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality); 489 } 490 491 if (rc) 492 return rc; 493 494 return crb_try_pluton_doorbell(priv, false); 495 } 496 497 static void crb_cancel(struct tpm_chip *chip) 498 { 499 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 500 int rc; 501 502 iowrite32(CRB_CANCEL_INVOKE, &priv->regs_t->ctrl_cancel); 503 504 if ((priv->sm == ACPI_TPM2_START_METHOD || 505 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) && 506 crb_do_acpi_start(chip)) 507 dev_err(&chip->dev, "ACPI Start failed\n"); 508 509 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 510 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality); 511 if (rc) 512 dev_err(&chip->dev, "FF-A Start failed\n"); 513 } 514 } 515 516 static bool crb_req_canceled(struct tpm_chip *chip, u8 status) 517 { 518 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 519 u32 cancel = ioread32(&priv->regs_t->ctrl_cancel); 520 521 return (cancel & CRB_CANCEL_INVOKE) == CRB_CANCEL_INVOKE; 522 } 523 524 static const struct tpm_class_ops tpm_crb = { 525 .flags = TPM_OPS_AUTO_STARTUP, 526 .status = crb_status, 527 .recv = crb_recv, 528 .send = crb_send, 529 .cancel = crb_cancel, 530 .req_canceled = crb_req_canceled, 531 .go_idle = crb_go_idle, 532 .cmd_ready = crb_cmd_ready, 533 .request_locality = crb_request_locality, 534 .relinquish_locality = crb_relinquish_locality, 535 .req_complete_mask = CRB_DRV_STS_COMPLETE, 536 .req_complete_val = CRB_DRV_STS_COMPLETE, 537 }; 538 539 static int crb_check_resource(struct acpi_resource *ares, void *data) 540 { 541 struct resource *iores_array = data; 542 struct resource_win win; 543 struct resource *res = &(win.res); 544 int i; 545 546 if (acpi_dev_resource_memory(ares, res) || 547 acpi_dev_resource_address_space(ares, &win)) { 548 for (i = 0; i < TPM_CRB_MAX_RESOURCES + 1; ++i) { 549 if (resource_type(iores_array + i) != IORESOURCE_MEM) { 550 iores_array[i] = *res; 551 iores_array[i].name = NULL; 552 break; 553 } 554 } 555 } 556 557 return 1; 558 } 559 560 static void __iomem *crb_map_res(struct device *dev, struct resource *iores, 561 void __iomem **iobase_ptr, u64 start, u32 size) 562 { 563 struct resource new_res = { 564 .start = start, 565 .end = start + size - 1, 566 .flags = IORESOURCE_MEM, 567 }; 568 569 /* Detect a 64 bit address on a 32 bit system */ 570 if (start != new_res.start) 571 return IOMEM_ERR_PTR(-EINVAL); 572 573 if (!iores) 574 return devm_ioremap_resource(dev, &new_res); 575 576 if (!*iobase_ptr) { 577 *iobase_ptr = devm_ioremap_resource(dev, iores); 578 if (IS_ERR(*iobase_ptr)) 579 return *iobase_ptr; 580 } 581 582 return *iobase_ptr + (new_res.start - iores->start); 583 } 584 585 /* 586 * Work around broken BIOSs that return inconsistent values from the ACPI 587 * region vs the registers. Trust the ACPI region. Such broken systems 588 * probably cannot send large TPM commands since the buffer will be truncated. 589 */ 590 static u64 crb_fixup_cmd_size(struct device *dev, struct resource *io_res, 591 u64 start, u64 size) 592 { 593 if (io_res->start > start || io_res->end < start) 594 return size; 595 596 if (start + size - 1 <= io_res->end) 597 return size; 598 599 dev_err(dev, 600 FW_BUG "ACPI region does not cover the entire command/response buffer. %pr vs %llx %llx\n", 601 io_res, start, size); 602 603 return io_res->end - start + 1; 604 } 605 606 static int crb_map_io(struct device *dev, struct crb_priv *priv, 607 struct acpi_table_tpm2 *buf) 608 { 609 struct acpi_device *device = ACPI_COMPANION(dev); 610 struct list_head acpi_resource_list; 611 struct resource iores_array[TPM_CRB_MAX_RESOURCES + 1] = { {0} }; 612 void __iomem *iobase_array[TPM_CRB_MAX_RESOURCES] = {NULL}; 613 struct resource *iores; 614 void __iomem **iobase_ptr; 615 int i; 616 u32 pa_high, pa_low; 617 u64 cmd_pa; 618 u32 cmd_size; 619 __le64 __rsp_pa; 620 u64 rsp_pa; 621 u32 rsp_size; 622 int ret; 623 624 /* 625 * Pluton sometimes does not define ACPI memory regions. 626 * Mapping is then done in crb_map_pluton 627 */ 628 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 629 INIT_LIST_HEAD(&acpi_resource_list); 630 ret = acpi_dev_get_resources(device, &acpi_resource_list, 631 crb_check_resource, iores_array); 632 if (ret < 0) 633 return ret; 634 acpi_dev_free_resource_list(&acpi_resource_list); 635 636 if (resource_type(iores_array) != IORESOURCE_MEM) { 637 dev_err(dev, FW_BUG "TPM2 ACPI table does not define a memory resource\n"); 638 return -EINVAL; 639 } else if (resource_type(iores_array + TPM_CRB_MAX_RESOURCES) == 640 IORESOURCE_MEM) { 641 dev_warn(dev, "TPM2 ACPI table defines too many memory resources\n"); 642 memset(iores_array + TPM_CRB_MAX_RESOURCES, 643 0, sizeof(*iores_array)); 644 iores_array[TPM_CRB_MAX_RESOURCES].flags = 0; 645 } 646 } 647 648 iores = NULL; 649 iobase_ptr = NULL; 650 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) { 651 if (buf->control_address >= iores_array[i].start && 652 buf->control_address + sizeof(struct crb_regs_tail) - 1 <= 653 iores_array[i].end) { 654 iores = iores_array + i; 655 iobase_ptr = iobase_array + i; 656 break; 657 } 658 } 659 660 priv->regs_t = crb_map_res(dev, iores, iobase_ptr, buf->control_address, 661 sizeof(struct crb_regs_tail)); 662 663 if (IS_ERR(priv->regs_t)) 664 return PTR_ERR(priv->regs_t); 665 666 /* The ACPI IO region starts at the head area and continues to include 667 * the control area, as one nice sane region except for some older 668 * stuff that puts the control area outside the ACPI IO region. 669 */ 670 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER || 671 priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA || 672 priv->sm == ACPI_TPM2_MEMORY_MAPPED) { 673 if (iores && 674 buf->control_address == iores->start + 675 sizeof(*priv->regs_h)) 676 priv->regs_h = *iobase_ptr; 677 else 678 dev_warn(dev, FW_BUG "Bad ACPI memory layout"); 679 } 680 681 ret = __crb_request_locality(dev, priv, 0); 682 if (ret) 683 return ret; 684 685 /* 686 * PTT HW bug w/a: wake up the device to access 687 * possibly not retained registers. 688 */ 689 ret = __crb_cmd_ready(dev, priv, 0); 690 if (ret) 691 goto out_relinquish_locality; 692 693 pa_high = ioread32(&priv->regs_t->ctrl_cmd_pa_high); 694 pa_low = ioread32(&priv->regs_t->ctrl_cmd_pa_low); 695 cmd_pa = ((u64)pa_high << 32) | pa_low; 696 cmd_size = ioread32(&priv->regs_t->ctrl_cmd_size); 697 698 iores = NULL; 699 iobase_ptr = NULL; 700 for (i = 0; iores_array[i].end; ++i) { 701 if (cmd_pa >= iores_array[i].start && 702 cmd_pa <= iores_array[i].end) { 703 iores = iores_array + i; 704 iobase_ptr = iobase_array + i; 705 break; 706 } 707 } 708 709 if (iores) 710 cmd_size = crb_fixup_cmd_size(dev, iores, cmd_pa, cmd_size); 711 712 dev_dbg(dev, "cmd_hi = %X cmd_low = %X cmd_size %X\n", 713 pa_high, pa_low, cmd_size); 714 715 priv->cmd = crb_map_res(dev, iores, iobase_ptr, cmd_pa, cmd_size); 716 if (IS_ERR(priv->cmd)) { 717 ret = PTR_ERR(priv->cmd); 718 goto out; 719 } 720 721 memcpy_fromio(&__rsp_pa, &priv->regs_t->ctrl_rsp_pa, 8); 722 rsp_pa = le64_to_cpu(__rsp_pa); 723 rsp_size = ioread32(&priv->regs_t->ctrl_rsp_size); 724 725 iores = NULL; 726 iobase_ptr = NULL; 727 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) { 728 if (rsp_pa >= iores_array[i].start && 729 rsp_pa <= iores_array[i].end) { 730 iores = iores_array + i; 731 iobase_ptr = iobase_array + i; 732 break; 733 } 734 } 735 736 if (iores) 737 rsp_size = crb_fixup_cmd_size(dev, iores, rsp_pa, rsp_size); 738 739 if (cmd_pa != rsp_pa) { 740 priv->rsp = crb_map_res(dev, iores, iobase_ptr, 741 rsp_pa, rsp_size); 742 ret = PTR_ERR_OR_ZERO(priv->rsp); 743 goto out; 744 } 745 746 /* According to the PTP specification, overlapping command and response 747 * buffer sizes must be identical. 748 */ 749 if (cmd_size != rsp_size) { 750 dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical"); 751 ret = -EINVAL; 752 goto out; 753 } 754 755 priv->rsp = priv->cmd; 756 757 out: 758 if (!ret) 759 priv->cmd_size = cmd_size; 760 761 __crb_go_idle(dev, priv, 0); 762 763 out_relinquish_locality: 764 765 __crb_relinquish_locality(dev, priv, 0); 766 767 return ret; 768 } 769 770 static int crb_map_pluton(struct device *dev, struct crb_priv *priv, 771 struct acpi_table_tpm2 *buf, struct tpm2_crb_pluton *crb_pluton) 772 { 773 priv->pluton_start_addr = crb_map_res(dev, NULL, NULL, 774 crb_pluton->start_addr, 4); 775 if (IS_ERR(priv->pluton_start_addr)) 776 return PTR_ERR(priv->pluton_start_addr); 777 778 priv->pluton_reply_addr = crb_map_res(dev, NULL, NULL, 779 crb_pluton->reply_addr, 4); 780 if (IS_ERR(priv->pluton_reply_addr)) 781 return PTR_ERR(priv->pluton_reply_addr); 782 783 return 0; 784 } 785 786 static int crb_acpi_probe(struct platform_device *pdev) 787 { 788 struct device *dev = &pdev->dev; 789 struct acpi_device *device = ACPI_COMPANION(dev); 790 struct acpi_table_tpm2 *buf; 791 struct crb_priv *priv; 792 struct tpm_chip *chip; 793 struct tpm2_crb_smc *crb_smc; 794 struct tpm2_crb_ffa *crb_ffa; 795 struct tpm2_crb_pluton *crb_pluton; 796 acpi_status status; 797 u32 sm; 798 int rc; 799 800 status = acpi_get_table(ACPI_SIG_TPM2, 1, 801 (struct acpi_table_header **) &buf); 802 if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) { 803 dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n"); 804 return -EINVAL; 805 } 806 807 /* Should the FIFO driver handle this? */ 808 sm = buf->start_method; 809 if (sm == ACPI_TPM2_MEMORY_MAPPED) { 810 rc = -ENODEV; 811 goto out; 812 } 813 814 priv = devm_kzalloc(dev, sizeof(struct crb_priv), GFP_KERNEL); 815 if (!priv) { 816 rc = -ENOMEM; 817 goto out; 818 } 819 820 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) { 821 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_smc))) { 822 dev_err(dev, 823 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 824 buf->header.length, 825 ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC); 826 rc = -EINVAL; 827 goto out; 828 } 829 crb_smc = ACPI_ADD_PTR(struct tpm2_crb_smc, buf, sizeof(*buf)); 830 priv->smc_func_id = crb_smc->smc_func_id; 831 } 832 833 if (sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 834 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_ffa))) { 835 dev_err(dev, 836 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 837 buf->header.length, 838 ACPI_TPM2_CRB_WITH_ARM_FFA); 839 rc = -EINVAL; 840 goto out; 841 } 842 crb_ffa = ACPI_ADD_PTR(struct tpm2_crb_ffa, buf, sizeof(*buf)); 843 priv->ffa_flags = crb_ffa->flags; 844 priv->ffa_attributes = crb_ffa->attributes; 845 rc = tpm_crb_ffa_init(); 846 if (rc) { 847 /* If FF-A driver is not available yet, request probe retry */ 848 if (rc == -ENOENT) 849 rc = -EPROBE_DEFER; 850 goto out; 851 } 852 } 853 854 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 855 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_pluton))) { 856 dev_err(dev, 857 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 858 buf->header.length, 859 ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON); 860 rc = -EINVAL; 861 goto out; 862 } 863 crb_pluton = ACPI_ADD_PTR(struct tpm2_crb_pluton, buf, sizeof(*buf)); 864 rc = crb_map_pluton(dev, priv, buf, crb_pluton); 865 if (rc) 866 goto out; 867 } 868 869 priv->sm = sm; 870 priv->hid = acpi_device_hid(device); 871 872 rc = crb_map_io(dev, priv, buf); 873 if (rc) 874 goto out; 875 876 chip = tpmm_chip_alloc(dev, &tpm_crb); 877 if (IS_ERR(chip)) { 878 rc = PTR_ERR(chip); 879 goto out; 880 } 881 882 dev_set_drvdata(&chip->dev, priv); 883 chip->acpi_dev_handle = device->handle; 884 chip->flags = TPM_CHIP_FLAG_TPM2; 885 886 rc = tpm_chip_bootstrap(chip); 887 if (rc) 888 goto out; 889 890 #ifdef CONFIG_X86 891 /* A quirk for https://www.amd.com/en/support/kb/faq/pa-410 */ 892 if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD && 893 priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 894 dev_info(dev, "Disabling hwrng\n"); 895 chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED; 896 } 897 #endif /* CONFIG_X86 */ 898 899 rc = tpm_chip_register(chip); 900 901 out: 902 acpi_put_table((struct acpi_table_header *)buf); 903 return rc; 904 } 905 906 static void crb_acpi_remove(struct platform_device *pdev) 907 { 908 tpm_chip_unregister(platform_get_drvdata(pdev)); 909 } 910 911 static const struct dev_pm_ops crb_pm = { 912 SET_SYSTEM_SLEEP_PM_OPS(tpm_pm_suspend, tpm_pm_resume) 913 }; 914 915 static const struct acpi_device_id crb_device_ids[] = { 916 {"MSFT0101", 0}, 917 {"", 0}, 918 }; 919 MODULE_DEVICE_TABLE(acpi, crb_device_ids); 920 921 static struct platform_driver crb_acpi_driver = { 922 .probe = crb_acpi_probe, 923 .remove = crb_acpi_remove, 924 .driver = { 925 .name = "tpm_crb_acpi", 926 .acpi_match_table = crb_device_ids, 927 .pm = &crb_pm, 928 }, 929 }; 930 931 module_platform_driver(crb_acpi_driver); 932 MODULE_AUTHOR("Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>"); 933 MODULE_DESCRIPTION("TPM2 Driver"); 934 MODULE_VERSION("0.1"); 935 MODULE_LICENSE("GPL"); 936