1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2014 Intel Corporation 4 * 5 * Authors: 6 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> 7 * 8 * Maintained by: <tpmdd-devel@lists.sourceforge.net> 9 * 10 * This device driver implements the TPM interface as defined in 11 * the TCG CRB 2.0 TPM specification. 12 */ 13 14 #include <linux/acpi.h> 15 #include <linux/highmem.h> 16 #include <linux/rculist.h> 17 #include <linux/module.h> 18 #include <linux/pm_runtime.h> 19 #ifdef CONFIG_ARM64 20 #include <linux/arm-smccc.h> 21 #endif 22 #include "tpm_crb_ffa.h" 23 #include "tpm.h" 24 25 #define ACPI_SIG_TPM2 "TPM2" 26 #define TPM_CRB_MAX_RESOURCES 3 27 28 static const guid_t crb_acpi_start_guid = 29 GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714, 30 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4); 31 32 enum crb_defaults { 33 CRB_ACPI_START_REVISION_ID = 1, 34 CRB_ACPI_START_INDEX = 1, 35 }; 36 37 enum crb_loc_ctrl { 38 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0), 39 CRB_LOC_CTRL_RELINQUISH = BIT(1), 40 }; 41 42 enum crb_loc_state { 43 CRB_LOC_STATE_LOC_ASSIGNED = BIT(1), 44 CRB_LOC_STATE_TPM_REG_VALID_STS = BIT(7), 45 }; 46 47 enum crb_ctrl_req { 48 CRB_CTRL_REQ_CMD_READY = BIT(0), 49 CRB_CTRL_REQ_GO_IDLE = BIT(1), 50 }; 51 52 enum crb_ctrl_sts { 53 CRB_CTRL_STS_ERROR = BIT(0), 54 CRB_CTRL_STS_TPM_IDLE = BIT(1), 55 }; 56 57 enum crb_start { 58 CRB_START_INVOKE = BIT(0), 59 }; 60 61 enum crb_cancel { 62 CRB_CANCEL_INVOKE = BIT(0), 63 }; 64 65 struct crb_regs_head { 66 u32 loc_state; 67 u32 reserved1; 68 u32 loc_ctrl; 69 u32 loc_sts; 70 u8 reserved2[32]; 71 u64 intf_id; 72 u64 ctrl_ext; 73 } __packed; 74 75 struct crb_regs_tail { 76 u32 ctrl_req; 77 u32 ctrl_sts; 78 u32 ctrl_cancel; 79 u32 ctrl_start; 80 u32 ctrl_int_enable; 81 u32 ctrl_int_sts; 82 u32 ctrl_cmd_size; 83 u32 ctrl_cmd_pa_low; 84 u32 ctrl_cmd_pa_high; 85 u32 ctrl_rsp_size; 86 u64 ctrl_rsp_pa; 87 } __packed; 88 89 enum crb_status { 90 CRB_DRV_STS_COMPLETE = BIT(0), 91 }; 92 93 struct crb_priv { 94 u32 sm; 95 const char *hid; 96 struct crb_regs_head __iomem *regs_h; 97 struct crb_regs_tail __iomem *regs_t; 98 u8 __iomem *cmd; 99 u8 __iomem *rsp; 100 u32 cmd_size; 101 u32 smc_func_id; 102 u32 __iomem *pluton_start_addr; 103 u32 __iomem *pluton_reply_addr; 104 u8 ffa_flags; 105 u8 ffa_attributes; 106 }; 107 108 struct tpm2_crb_smc { 109 u32 interrupt; 110 u8 interrupt_flags; 111 u8 op_flags; 112 u16 reserved2; 113 u32 smc_func_id; 114 }; 115 116 /* CRB over FFA start method parameters in TCG2 ACPI table */ 117 struct tpm2_crb_ffa { 118 u8 flags; 119 u8 attributes; 120 u16 partition_id; 121 u8 reserved[8]; 122 }; 123 124 struct tpm2_crb_pluton { 125 u64 start_addr; 126 u64 reply_addr; 127 }; 128 129 /* 130 * Returns true if the start method supports idle. 131 */ 132 static inline bool tpm_crb_has_idle(u32 start_method) 133 { 134 return !(start_method == ACPI_TPM2_START_METHOD || 135 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD || 136 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC); 137 } 138 139 static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, 140 unsigned long timeout) 141 { 142 ktime_t start; 143 ktime_t stop; 144 145 start = ktime_get(); 146 stop = ktime_add(start, ms_to_ktime(timeout)); 147 148 do { 149 if ((ioread32(reg) & mask) == value) 150 return true; 151 152 usleep_range(50, 100); 153 } while (ktime_before(ktime_get(), stop)); 154 155 return ((ioread32(reg) & mask) == value); 156 } 157 158 static int crb_try_pluton_doorbell(struct crb_priv *priv, bool wait_for_complete) 159 { 160 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) 161 return 0; 162 163 if (!crb_wait_for_reg_32(priv->pluton_reply_addr, ~0, 1, TPM2_TIMEOUT_C)) 164 return -ETIME; 165 166 iowrite32(1, priv->pluton_start_addr); 167 if (wait_for_complete == false) 168 return 0; 169 170 if (!crb_wait_for_reg_32(priv->pluton_start_addr, 171 0xffffffff, 0, 200)) 172 return -ETIME; 173 174 return 0; 175 } 176 177 /** 178 * __crb_go_idle - request tpm crb device to go the idle state 179 * 180 * @dev: crb device 181 * @priv: crb private data 182 * @loc: locality 183 * 184 * Write CRB_CTRL_REQ_GO_IDLE to TPM_CRB_CTRL_REQ 185 * The device should respond within TIMEOUT_C by clearing the bit. 186 * Anyhow, we do not wait here as a consequent CMD_READY request 187 * will be handled correctly even if idle was not completed. 188 * 189 * The function does nothing for devices with ACPI-start method 190 * or SMC-start method. 191 * 192 * Return: 0 always 193 */ 194 static int __crb_go_idle(struct device *dev, struct crb_priv *priv, int loc) 195 { 196 int rc; 197 198 if (!tpm_crb_has_idle(priv->sm)) 199 return 0; 200 201 iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req); 202 203 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 204 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc); 205 if (rc) 206 return rc; 207 } 208 209 rc = crb_try_pluton_doorbell(priv, true); 210 if (rc) 211 return rc; 212 213 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, 214 CRB_CTRL_REQ_GO_IDLE/* mask */, 215 0, /* value */ 216 TPM2_TIMEOUT_C)) { 217 dev_warn(dev, "goIdle timed out\n"); 218 return -ETIME; 219 } 220 221 return 0; 222 } 223 224 static int crb_go_idle(struct tpm_chip *chip) 225 { 226 struct device *dev = &chip->dev; 227 struct crb_priv *priv = dev_get_drvdata(dev); 228 229 return __crb_go_idle(dev, priv, chip->locality); 230 } 231 232 /** 233 * __crb_cmd_ready - request tpm crb device to enter ready state 234 * 235 * @dev: crb device 236 * @priv: crb private data 237 * @loc: locality 238 * 239 * Write CRB_CTRL_REQ_CMD_READY to TPM_CRB_CTRL_REQ 240 * and poll till the device acknowledge it by clearing the bit. 241 * The device should respond within TIMEOUT_C. 242 * 243 * The function does nothing for devices with ACPI-start method 244 * or SMC-start method. 245 * 246 * Return: 0 on success -ETIME on timeout; 247 */ 248 static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv, int loc) 249 { 250 int rc; 251 252 if (!tpm_crb_has_idle(priv->sm)) 253 return 0; 254 255 iowrite32(CRB_CTRL_REQ_CMD_READY, &priv->regs_t->ctrl_req); 256 257 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 258 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc); 259 if (rc) 260 return rc; 261 } 262 263 rc = crb_try_pluton_doorbell(priv, true); 264 if (rc) 265 return rc; 266 267 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, 268 CRB_CTRL_REQ_CMD_READY /* mask */, 269 0, /* value */ 270 TPM2_TIMEOUT_C)) { 271 dev_warn(dev, "cmdReady timed out\n"); 272 return -ETIME; 273 } 274 275 return 0; 276 } 277 278 static int crb_cmd_ready(struct tpm_chip *chip) 279 { 280 struct device *dev = &chip->dev; 281 struct crb_priv *priv = dev_get_drvdata(dev); 282 283 return __crb_cmd_ready(dev, priv, chip->locality); 284 } 285 286 static int __crb_request_locality(struct device *dev, 287 struct crb_priv *priv, int loc) 288 { 289 u32 value = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS; 290 int rc; 291 292 if (!priv->regs_h) 293 return 0; 294 295 iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl); 296 297 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 298 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc); 299 if (rc) 300 return rc; 301 } 302 303 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value, 304 TPM2_TIMEOUT_C)) { 305 dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n"); 306 return -ETIME; 307 } 308 309 return 0; 310 } 311 312 static int crb_request_locality(struct tpm_chip *chip, int loc) 313 { 314 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 315 316 return __crb_request_locality(&chip->dev, priv, loc); 317 } 318 319 static int __crb_relinquish_locality(struct device *dev, 320 struct crb_priv *priv, int loc) 321 { 322 u32 mask = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS; 323 u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS; 324 int rc; 325 326 if (!priv->regs_h) 327 return 0; 328 329 iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl); 330 331 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 332 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc); 333 if (rc) 334 return rc; 335 } 336 337 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value, 338 TPM2_TIMEOUT_C)) { 339 dev_warn(dev, "TPM_LOC_STATE_x.Relinquish timed out\n"); 340 return -ETIME; 341 } 342 343 return 0; 344 } 345 346 static int crb_relinquish_locality(struct tpm_chip *chip, int loc) 347 { 348 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 349 350 return __crb_relinquish_locality(&chip->dev, priv, loc); 351 } 352 353 static u8 crb_status(struct tpm_chip *chip) 354 { 355 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 356 u8 sts = 0; 357 358 if ((ioread32(&priv->regs_t->ctrl_start) & CRB_START_INVOKE) != 359 CRB_START_INVOKE) 360 sts |= CRB_DRV_STS_COMPLETE; 361 362 return sts; 363 } 364 365 static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) 366 { 367 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 368 unsigned int expected; 369 370 /* A sanity check that the upper layer wants to get at least the header 371 * as that is the minimum size for any TPM response. 372 */ 373 if (count < TPM_HEADER_SIZE) 374 return -EIO; 375 376 /* If this bit is set, according to the spec, the TPM is in 377 * unrecoverable condition. 378 */ 379 if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR) 380 return -EIO; 381 382 /* Read the first 8 bytes in order to get the length of the response. 383 * We read exactly a quad word in order to make sure that the remaining 384 * reads will be aligned. 385 */ 386 memcpy_fromio(buf, priv->rsp, 8); 387 388 expected = be32_to_cpup((__be32 *)&buf[2]); 389 if (expected > count || expected < TPM_HEADER_SIZE) 390 return -EIO; 391 392 memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8); 393 394 return expected; 395 } 396 397 static int crb_do_acpi_start(struct tpm_chip *chip) 398 { 399 union acpi_object *obj; 400 int rc; 401 402 obj = acpi_evaluate_dsm(chip->acpi_dev_handle, 403 &crb_acpi_start_guid, 404 CRB_ACPI_START_REVISION_ID, 405 CRB_ACPI_START_INDEX, 406 NULL); 407 if (!obj) 408 return -ENXIO; 409 rc = obj->integer.value == 0 ? 0 : -ENXIO; 410 ACPI_FREE(obj); 411 return rc; 412 } 413 414 #ifdef CONFIG_ARM64 415 /* 416 * This is a TPM Command Response Buffer start method that invokes a 417 * Secure Monitor Call to request the firmware to execute or cancel 418 * a TPM 2.0 command. 419 */ 420 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id) 421 { 422 struct arm_smccc_res res; 423 424 arm_smccc_smc(func_id, 0, 0, 0, 0, 0, 0, 0, &res); 425 if (res.a0 != 0) { 426 dev_err(dev, 427 FW_BUG "tpm_crb_smc_start() returns res.a0 = 0x%lx\n", 428 res.a0); 429 return -EIO; 430 } 431 432 return 0; 433 } 434 #else 435 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id) 436 { 437 dev_err(dev, FW_BUG "tpm_crb: incorrect start method\n"); 438 return -EINVAL; 439 } 440 #endif 441 442 static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len) 443 { 444 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 445 int rc = 0; 446 447 /* Zero the cancel register so that the next command will not get 448 * canceled. 449 */ 450 iowrite32(0, &priv->regs_t->ctrl_cancel); 451 452 if (len > priv->cmd_size) { 453 dev_err(&chip->dev, "invalid command count value %zd %d\n", 454 len, priv->cmd_size); 455 return -E2BIG; 456 } 457 458 /* Seems to be necessary for every command */ 459 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) 460 __crb_cmd_ready(&chip->dev, priv, chip->locality); 461 462 memcpy_toio(priv->cmd, buf, len); 463 464 /* Make sure that cmd is populated before issuing start. */ 465 wmb(); 466 467 /* The reason for the extra quirk is that the PTT in 4th Gen Core CPUs 468 * report only ACPI start but in practice seems to require both 469 * CRB start, hence invoking CRB start method if hid == MSFT0101. 470 */ 471 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER || 472 priv->sm == ACPI_TPM2_MEMORY_MAPPED || 473 !strcmp(priv->hid, "MSFT0101")) 474 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 475 476 if (priv->sm == ACPI_TPM2_START_METHOD || 477 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) 478 rc = crb_do_acpi_start(chip); 479 480 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) { 481 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 482 rc = tpm_crb_smc_start(&chip->dev, priv->smc_func_id); 483 } 484 485 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 486 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 487 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality); 488 } 489 490 if (rc) 491 return rc; 492 493 return crb_try_pluton_doorbell(priv, false); 494 } 495 496 static void crb_cancel(struct tpm_chip *chip) 497 { 498 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 499 int rc; 500 501 iowrite32(CRB_CANCEL_INVOKE, &priv->regs_t->ctrl_cancel); 502 503 if ((priv->sm == ACPI_TPM2_START_METHOD || 504 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) && 505 crb_do_acpi_start(chip)) 506 dev_err(&chip->dev, "ACPI Start failed\n"); 507 508 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 509 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality); 510 if (rc) 511 dev_err(&chip->dev, "FF-A Start failed\n"); 512 } 513 } 514 515 static bool crb_req_canceled(struct tpm_chip *chip, u8 status) 516 { 517 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 518 u32 cancel = ioread32(&priv->regs_t->ctrl_cancel); 519 520 return (cancel & CRB_CANCEL_INVOKE) == CRB_CANCEL_INVOKE; 521 } 522 523 static const struct tpm_class_ops tpm_crb = { 524 .flags = TPM_OPS_AUTO_STARTUP, 525 .status = crb_status, 526 .recv = crb_recv, 527 .send = crb_send, 528 .cancel = crb_cancel, 529 .req_canceled = crb_req_canceled, 530 .go_idle = crb_go_idle, 531 .cmd_ready = crb_cmd_ready, 532 .request_locality = crb_request_locality, 533 .relinquish_locality = crb_relinquish_locality, 534 .req_complete_mask = CRB_DRV_STS_COMPLETE, 535 .req_complete_val = CRB_DRV_STS_COMPLETE, 536 }; 537 538 static int crb_check_resource(struct acpi_resource *ares, void *data) 539 { 540 struct resource *iores_array = data; 541 struct resource_win win; 542 struct resource *res = &(win.res); 543 int i; 544 545 if (acpi_dev_resource_memory(ares, res) || 546 acpi_dev_resource_address_space(ares, &win)) { 547 for (i = 0; i < TPM_CRB_MAX_RESOURCES + 1; ++i) { 548 if (resource_type(iores_array + i) != IORESOURCE_MEM) { 549 iores_array[i] = *res; 550 iores_array[i].name = NULL; 551 break; 552 } 553 } 554 } 555 556 return 1; 557 } 558 559 static void __iomem *crb_map_res(struct device *dev, struct resource *iores, 560 void __iomem **iobase_ptr, u64 start, u32 size) 561 { 562 struct resource new_res = { 563 .start = start, 564 .end = start + size - 1, 565 .flags = IORESOURCE_MEM, 566 }; 567 568 /* Detect a 64 bit address on a 32 bit system */ 569 if (start != new_res.start) 570 return IOMEM_ERR_PTR(-EINVAL); 571 572 if (!iores) 573 return devm_ioremap_resource(dev, &new_res); 574 575 if (!*iobase_ptr) { 576 *iobase_ptr = devm_ioremap_resource(dev, iores); 577 if (IS_ERR(*iobase_ptr)) 578 return *iobase_ptr; 579 } 580 581 return *iobase_ptr + (new_res.start - iores->start); 582 } 583 584 /* 585 * Work around broken BIOSs that return inconsistent values from the ACPI 586 * region vs the registers. Trust the ACPI region. Such broken systems 587 * probably cannot send large TPM commands since the buffer will be truncated. 588 */ 589 static u64 crb_fixup_cmd_size(struct device *dev, struct resource *io_res, 590 u64 start, u64 size) 591 { 592 if (io_res->start > start || io_res->end < start) 593 return size; 594 595 if (start + size - 1 <= io_res->end) 596 return size; 597 598 dev_err(dev, 599 FW_BUG "ACPI region does not cover the entire command/response buffer. %pr vs %llx %llx\n", 600 io_res, start, size); 601 602 return io_res->end - start + 1; 603 } 604 605 static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, 606 struct acpi_table_tpm2 *buf) 607 { 608 struct list_head acpi_resource_list; 609 struct resource iores_array[TPM_CRB_MAX_RESOURCES + 1] = { {0} }; 610 void __iomem *iobase_array[TPM_CRB_MAX_RESOURCES] = {NULL}; 611 struct device *dev = &device->dev; 612 struct resource *iores; 613 void __iomem **iobase_ptr; 614 int i; 615 u32 pa_high, pa_low; 616 u64 cmd_pa; 617 u32 cmd_size; 618 __le64 __rsp_pa; 619 u64 rsp_pa; 620 u32 rsp_size; 621 int ret; 622 623 /* 624 * Pluton sometimes does not define ACPI memory regions. 625 * Mapping is then done in crb_map_pluton 626 */ 627 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 628 INIT_LIST_HEAD(&acpi_resource_list); 629 ret = acpi_dev_get_resources(device, &acpi_resource_list, 630 crb_check_resource, iores_array); 631 if (ret < 0) 632 return ret; 633 acpi_dev_free_resource_list(&acpi_resource_list); 634 635 if (resource_type(iores_array) != IORESOURCE_MEM) { 636 dev_err(dev, FW_BUG "TPM2 ACPI table does not define a memory resource\n"); 637 return -EINVAL; 638 } else if (resource_type(iores_array + TPM_CRB_MAX_RESOURCES) == 639 IORESOURCE_MEM) { 640 dev_warn(dev, "TPM2 ACPI table defines too many memory resources\n"); 641 memset(iores_array + TPM_CRB_MAX_RESOURCES, 642 0, sizeof(*iores_array)); 643 iores_array[TPM_CRB_MAX_RESOURCES].flags = 0; 644 } 645 } 646 647 iores = NULL; 648 iobase_ptr = NULL; 649 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) { 650 if (buf->control_address >= iores_array[i].start && 651 buf->control_address + sizeof(struct crb_regs_tail) - 1 <= 652 iores_array[i].end) { 653 iores = iores_array + i; 654 iobase_ptr = iobase_array + i; 655 break; 656 } 657 } 658 659 priv->regs_t = crb_map_res(dev, iores, iobase_ptr, buf->control_address, 660 sizeof(struct crb_regs_tail)); 661 662 if (IS_ERR(priv->regs_t)) 663 return PTR_ERR(priv->regs_t); 664 665 /* The ACPI IO region starts at the head area and continues to include 666 * the control area, as one nice sane region except for some older 667 * stuff that puts the control area outside the ACPI IO region. 668 */ 669 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER || 670 priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA || 671 priv->sm == ACPI_TPM2_MEMORY_MAPPED) { 672 if (iores && 673 buf->control_address == iores->start + 674 sizeof(*priv->regs_h)) 675 priv->regs_h = *iobase_ptr; 676 else 677 dev_warn(dev, FW_BUG "Bad ACPI memory layout"); 678 } 679 680 ret = __crb_request_locality(dev, priv, 0); 681 if (ret) 682 return ret; 683 684 /* 685 * PTT HW bug w/a: wake up the device to access 686 * possibly not retained registers. 687 */ 688 ret = __crb_cmd_ready(dev, priv, 0); 689 if (ret) 690 goto out_relinquish_locality; 691 692 pa_high = ioread32(&priv->regs_t->ctrl_cmd_pa_high); 693 pa_low = ioread32(&priv->regs_t->ctrl_cmd_pa_low); 694 cmd_pa = ((u64)pa_high << 32) | pa_low; 695 cmd_size = ioread32(&priv->regs_t->ctrl_cmd_size); 696 697 iores = NULL; 698 iobase_ptr = NULL; 699 for (i = 0; iores_array[i].end; ++i) { 700 if (cmd_pa >= iores_array[i].start && 701 cmd_pa <= iores_array[i].end) { 702 iores = iores_array + i; 703 iobase_ptr = iobase_array + i; 704 break; 705 } 706 } 707 708 if (iores) 709 cmd_size = crb_fixup_cmd_size(dev, iores, cmd_pa, cmd_size); 710 711 dev_dbg(dev, "cmd_hi = %X cmd_low = %X cmd_size %X\n", 712 pa_high, pa_low, cmd_size); 713 714 priv->cmd = crb_map_res(dev, iores, iobase_ptr, cmd_pa, cmd_size); 715 if (IS_ERR(priv->cmd)) { 716 ret = PTR_ERR(priv->cmd); 717 goto out; 718 } 719 720 memcpy_fromio(&__rsp_pa, &priv->regs_t->ctrl_rsp_pa, 8); 721 rsp_pa = le64_to_cpu(__rsp_pa); 722 rsp_size = ioread32(&priv->regs_t->ctrl_rsp_size); 723 724 iores = NULL; 725 iobase_ptr = NULL; 726 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) { 727 if (rsp_pa >= iores_array[i].start && 728 rsp_pa <= iores_array[i].end) { 729 iores = iores_array + i; 730 iobase_ptr = iobase_array + i; 731 break; 732 } 733 } 734 735 if (iores) 736 rsp_size = crb_fixup_cmd_size(dev, iores, rsp_pa, rsp_size); 737 738 if (cmd_pa != rsp_pa) { 739 priv->rsp = crb_map_res(dev, iores, iobase_ptr, 740 rsp_pa, rsp_size); 741 ret = PTR_ERR_OR_ZERO(priv->rsp); 742 goto out; 743 } 744 745 /* According to the PTP specification, overlapping command and response 746 * buffer sizes must be identical. 747 */ 748 if (cmd_size != rsp_size) { 749 dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical"); 750 ret = -EINVAL; 751 goto out; 752 } 753 754 priv->rsp = priv->cmd; 755 756 out: 757 if (!ret) 758 priv->cmd_size = cmd_size; 759 760 __crb_go_idle(dev, priv, 0); 761 762 out_relinquish_locality: 763 764 __crb_relinquish_locality(dev, priv, 0); 765 766 return ret; 767 } 768 769 static int crb_map_pluton(struct device *dev, struct crb_priv *priv, 770 struct acpi_table_tpm2 *buf, struct tpm2_crb_pluton *crb_pluton) 771 { 772 priv->pluton_start_addr = crb_map_res(dev, NULL, NULL, 773 crb_pluton->start_addr, 4); 774 if (IS_ERR(priv->pluton_start_addr)) 775 return PTR_ERR(priv->pluton_start_addr); 776 777 priv->pluton_reply_addr = crb_map_res(dev, NULL, NULL, 778 crb_pluton->reply_addr, 4); 779 if (IS_ERR(priv->pluton_reply_addr)) 780 return PTR_ERR(priv->pluton_reply_addr); 781 782 return 0; 783 } 784 785 static int crb_acpi_add(struct acpi_device *device) 786 { 787 struct acpi_table_tpm2 *buf; 788 struct crb_priv *priv; 789 struct tpm_chip *chip; 790 struct device *dev = &device->dev; 791 struct tpm2_crb_smc *crb_smc; 792 struct tpm2_crb_ffa *crb_ffa; 793 struct tpm2_crb_pluton *crb_pluton; 794 acpi_status status; 795 u32 sm; 796 int rc; 797 798 status = acpi_get_table(ACPI_SIG_TPM2, 1, 799 (struct acpi_table_header **) &buf); 800 if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) { 801 dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n"); 802 return -EINVAL; 803 } 804 805 /* Should the FIFO driver handle this? */ 806 sm = buf->start_method; 807 if (sm == ACPI_TPM2_MEMORY_MAPPED) { 808 rc = -ENODEV; 809 goto out; 810 } 811 812 priv = devm_kzalloc(dev, sizeof(struct crb_priv), GFP_KERNEL); 813 if (!priv) { 814 rc = -ENOMEM; 815 goto out; 816 } 817 818 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) { 819 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_smc))) { 820 dev_err(dev, 821 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 822 buf->header.length, 823 ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC); 824 rc = -EINVAL; 825 goto out; 826 } 827 crb_smc = ACPI_ADD_PTR(struct tpm2_crb_smc, buf, sizeof(*buf)); 828 priv->smc_func_id = crb_smc->smc_func_id; 829 } 830 831 if (sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 832 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_ffa))) { 833 dev_err(dev, 834 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 835 buf->header.length, 836 ACPI_TPM2_CRB_WITH_ARM_FFA); 837 rc = -EINVAL; 838 goto out; 839 } 840 crb_ffa = ACPI_ADD_PTR(struct tpm2_crb_ffa, buf, sizeof(*buf)); 841 priv->ffa_flags = crb_ffa->flags; 842 priv->ffa_attributes = crb_ffa->attributes; 843 rc = tpm_crb_ffa_init(); 844 if (rc) { 845 /* If FF-A driver is not available yet, request probe retry */ 846 if (rc == -ENOENT) 847 rc = -EPROBE_DEFER; 848 goto out; 849 } 850 } 851 852 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 853 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_pluton))) { 854 dev_err(dev, 855 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 856 buf->header.length, 857 ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON); 858 rc = -EINVAL; 859 goto out; 860 } 861 crb_pluton = ACPI_ADD_PTR(struct tpm2_crb_pluton, buf, sizeof(*buf)); 862 rc = crb_map_pluton(dev, priv, buf, crb_pluton); 863 if (rc) 864 goto out; 865 } 866 867 priv->sm = sm; 868 priv->hid = acpi_device_hid(device); 869 870 rc = crb_map_io(device, priv, buf); 871 if (rc) 872 goto out; 873 874 chip = tpmm_chip_alloc(dev, &tpm_crb); 875 if (IS_ERR(chip)) { 876 rc = PTR_ERR(chip); 877 goto out; 878 } 879 880 dev_set_drvdata(&chip->dev, priv); 881 chip->acpi_dev_handle = device->handle; 882 chip->flags = TPM_CHIP_FLAG_TPM2; 883 884 rc = tpm_chip_bootstrap(chip); 885 if (rc) 886 goto out; 887 888 #ifdef CONFIG_X86 889 /* A quirk for https://www.amd.com/en/support/kb/faq/pa-410 */ 890 if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD && 891 priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 892 dev_info(dev, "Disabling hwrng\n"); 893 chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED; 894 } 895 #endif /* CONFIG_X86 */ 896 897 rc = tpm_chip_register(chip); 898 899 out: 900 acpi_put_table((struct acpi_table_header *)buf); 901 return rc; 902 } 903 904 static void crb_acpi_remove(struct acpi_device *device) 905 { 906 struct device *dev = &device->dev; 907 struct tpm_chip *chip = dev_get_drvdata(dev); 908 909 tpm_chip_unregister(chip); 910 } 911 912 static const struct dev_pm_ops crb_pm = { 913 SET_SYSTEM_SLEEP_PM_OPS(tpm_pm_suspend, tpm_pm_resume) 914 }; 915 916 static const struct acpi_device_id crb_device_ids[] = { 917 {"MSFT0101", 0}, 918 {"", 0}, 919 }; 920 MODULE_DEVICE_TABLE(acpi, crb_device_ids); 921 922 static struct acpi_driver crb_acpi_driver = { 923 .name = "tpm_crb", 924 .ids = crb_device_ids, 925 .ops = { 926 .add = crb_acpi_add, 927 .remove = crb_acpi_remove, 928 }, 929 .drv = { 930 .pm = &crb_pm, 931 }, 932 }; 933 934 module_acpi_driver(crb_acpi_driver); 935 MODULE_AUTHOR("Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>"); 936 MODULE_DESCRIPTION("TPM2 Driver"); 937 MODULE_VERSION("0.1"); 938 MODULE_LICENSE("GPL"); 939