1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2014 Intel Corporation 4 * 5 * Authors: 6 * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> 7 * 8 * Maintained by: <tpmdd-devel@lists.sourceforge.net> 9 * 10 * This device driver implements the TPM interface as defined in 11 * the TCG CRB 2.0 TPM specification. 12 */ 13 14 #include <linux/acpi.h> 15 #include <linux/highmem.h> 16 #include <linux/rculist.h> 17 #include <linux/module.h> 18 #include <linux/pm_runtime.h> 19 #ifdef CONFIG_ARM64 20 #include <linux/arm-smccc.h> 21 #endif 22 #include "tpm_crb_ffa.h" 23 #include "tpm.h" 24 25 #define ACPI_SIG_TPM2 "TPM2" 26 #define TPM_CRB_MAX_RESOURCES 3 27 28 static const guid_t crb_acpi_start_guid = 29 GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714, 30 0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4); 31 32 enum crb_defaults { 33 CRB_ACPI_START_REVISION_ID = 1, 34 CRB_ACPI_START_INDEX = 1, 35 }; 36 37 enum crb_loc_ctrl { 38 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0), 39 CRB_LOC_CTRL_RELINQUISH = BIT(1), 40 }; 41 42 enum crb_loc_state { 43 CRB_LOC_STATE_LOC_ASSIGNED = BIT(1), 44 CRB_LOC_STATE_TPM_REG_VALID_STS = BIT(7), 45 }; 46 47 enum crb_ctrl_req { 48 CRB_CTRL_REQ_CMD_READY = BIT(0), 49 CRB_CTRL_REQ_GO_IDLE = BIT(1), 50 }; 51 52 enum crb_ctrl_sts { 53 CRB_CTRL_STS_ERROR = BIT(0), 54 CRB_CTRL_STS_TPM_IDLE = BIT(1), 55 }; 56 57 enum crb_start { 58 CRB_START_INVOKE = BIT(0), 59 }; 60 61 enum crb_cancel { 62 CRB_CANCEL_INVOKE = BIT(0), 63 }; 64 65 struct crb_regs_head { 66 u32 loc_state; 67 u32 reserved1; 68 u32 loc_ctrl; 69 u32 loc_sts; 70 u8 reserved2[32]; 71 u64 intf_id; 72 u64 ctrl_ext; 73 } __packed; 74 75 struct crb_regs_tail { 76 u32 ctrl_req; 77 u32 ctrl_sts; 78 u32 ctrl_cancel; 79 u32 ctrl_start; 80 u32 ctrl_int_enable; 81 u32 ctrl_int_sts; 82 u32 ctrl_cmd_size; 83 u32 ctrl_cmd_pa_low; 84 u32 ctrl_cmd_pa_high; 85 u32 ctrl_rsp_size; 86 u64 ctrl_rsp_pa; 87 } __packed; 88 89 enum crb_status { 90 CRB_DRV_STS_COMPLETE = BIT(0), 91 }; 92 93 struct crb_priv { 94 u32 sm; 95 const char *hid; 96 struct crb_regs_head __iomem *regs_h; 97 struct crb_regs_tail __iomem *regs_t; 98 u8 __iomem *cmd; 99 u8 __iomem *rsp; 100 u32 cmd_size; 101 u32 smc_func_id; 102 u32 __iomem *pluton_start_addr; 103 u32 __iomem *pluton_reply_addr; 104 u8 ffa_flags; 105 u8 ffa_attributes; 106 }; 107 108 struct tpm2_crb_smc { 109 u32 interrupt; 110 u8 interrupt_flags; 111 u8 op_flags; 112 u16 reserved2; 113 u32 smc_func_id; 114 }; 115 116 /* CRB over FFA start method parameters in TCG2 ACPI table */ 117 struct tpm2_crb_ffa { 118 u8 flags; 119 u8 attributes; 120 u16 partition_id; 121 u8 reserved[8]; 122 }; 123 124 struct tpm2_crb_pluton { 125 u64 start_addr; 126 u64 reply_addr; 127 }; 128 129 /* 130 * Returns true if the start method supports idle. 131 */ 132 static inline bool tpm_crb_has_idle(u32 start_method) 133 { 134 return !(start_method == ACPI_TPM2_START_METHOD || 135 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD || 136 start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC); 137 } 138 139 static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, 140 unsigned long timeout) 141 { 142 ktime_t start; 143 ktime_t stop; 144 145 start = ktime_get(); 146 stop = ktime_add(start, ms_to_ktime(timeout)); 147 148 do { 149 if ((ioread32(reg) & mask) == value) 150 return true; 151 152 usleep_range(50, 100); 153 } while (ktime_before(ktime_get(), stop)); 154 155 return ((ioread32(reg) & mask) == value); 156 } 157 158 static int crb_try_pluton_doorbell(struct crb_priv *priv, bool wait_for_complete) 159 { 160 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) 161 return 0; 162 163 if (!crb_wait_for_reg_32(priv->pluton_reply_addr, ~0, 1, TPM2_TIMEOUT_C)) 164 return -ETIME; 165 166 iowrite32(1, priv->pluton_start_addr); 167 if (wait_for_complete == false) 168 return 0; 169 170 if (!crb_wait_for_reg_32(priv->pluton_start_addr, 171 0xffffffff, 0, 200)) 172 return -ETIME; 173 174 return 0; 175 } 176 177 /** 178 * __crb_go_idle - request tpm crb device to go the idle state 179 * 180 * @dev: crb device 181 * @priv: crb private data 182 * 183 * Write CRB_CTRL_REQ_GO_IDLE to TPM_CRB_CTRL_REQ 184 * The device should respond within TIMEOUT_C by clearing the bit. 185 * Anyhow, we do not wait here as a consequent CMD_READY request 186 * will be handled correctly even if idle was not completed. 187 * 188 * The function does nothing for devices with ACPI-start method 189 * or SMC-start method. 190 * 191 * Return: 0 always 192 */ 193 static int __crb_go_idle(struct device *dev, struct crb_priv *priv, int loc) 194 { 195 int rc; 196 197 if (!tpm_crb_has_idle(priv->sm)) 198 return 0; 199 200 iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req); 201 202 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 203 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc); 204 if (rc) 205 return rc; 206 } 207 208 rc = crb_try_pluton_doorbell(priv, true); 209 if (rc) 210 return rc; 211 212 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, 213 CRB_CTRL_REQ_GO_IDLE/* mask */, 214 0, /* value */ 215 TPM2_TIMEOUT_C)) { 216 dev_warn(dev, "goIdle timed out\n"); 217 return -ETIME; 218 } 219 220 return 0; 221 } 222 223 static int crb_go_idle(struct tpm_chip *chip) 224 { 225 struct device *dev = &chip->dev; 226 struct crb_priv *priv = dev_get_drvdata(dev); 227 228 return __crb_go_idle(dev, priv, chip->locality); 229 } 230 231 /** 232 * __crb_cmd_ready - request tpm crb device to enter ready state 233 * 234 * @dev: crb device 235 * @priv: crb private data 236 * 237 * Write CRB_CTRL_REQ_CMD_READY to TPM_CRB_CTRL_REQ 238 * and poll till the device acknowledge it by clearing the bit. 239 * The device should respond within TIMEOUT_C. 240 * 241 * The function does nothing for devices with ACPI-start method 242 * or SMC-start method. 243 * 244 * Return: 0 on success -ETIME on timeout; 245 */ 246 static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv, int loc) 247 { 248 int rc; 249 250 if (!tpm_crb_has_idle(priv->sm)) 251 return 0; 252 253 iowrite32(CRB_CTRL_REQ_CMD_READY, &priv->regs_t->ctrl_req); 254 255 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 256 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc); 257 if (rc) 258 return rc; 259 } 260 261 rc = crb_try_pluton_doorbell(priv, true); 262 if (rc) 263 return rc; 264 265 if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, 266 CRB_CTRL_REQ_CMD_READY /* mask */, 267 0, /* value */ 268 TPM2_TIMEOUT_C)) { 269 dev_warn(dev, "cmdReady timed out\n"); 270 return -ETIME; 271 } 272 273 return 0; 274 } 275 276 static int crb_cmd_ready(struct tpm_chip *chip) 277 { 278 struct device *dev = &chip->dev; 279 struct crb_priv *priv = dev_get_drvdata(dev); 280 281 return __crb_cmd_ready(dev, priv, chip->locality); 282 } 283 284 static int __crb_request_locality(struct device *dev, 285 struct crb_priv *priv, int loc) 286 { 287 u32 value = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS; 288 int rc; 289 290 if (!priv->regs_h) 291 return 0; 292 293 iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl); 294 295 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 296 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc); 297 if (rc) 298 return rc; 299 } 300 301 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value, 302 TPM2_TIMEOUT_C)) { 303 dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n"); 304 return -ETIME; 305 } 306 307 return 0; 308 } 309 310 static int crb_request_locality(struct tpm_chip *chip, int loc) 311 { 312 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 313 314 return __crb_request_locality(&chip->dev, priv, loc); 315 } 316 317 static int __crb_relinquish_locality(struct device *dev, 318 struct crb_priv *priv, int loc) 319 { 320 u32 mask = CRB_LOC_STATE_LOC_ASSIGNED | CRB_LOC_STATE_TPM_REG_VALID_STS; 321 u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS; 322 int rc; 323 324 if (!priv->regs_h) 325 return 0; 326 327 iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl); 328 329 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 330 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc); 331 if (rc) 332 return rc; 333 } 334 335 if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value, 336 TPM2_TIMEOUT_C)) { 337 dev_warn(dev, "TPM_LOC_STATE_x.Relinquish timed out\n"); 338 return -ETIME; 339 } 340 341 return 0; 342 } 343 344 static int crb_relinquish_locality(struct tpm_chip *chip, int loc) 345 { 346 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 347 348 return __crb_relinquish_locality(&chip->dev, priv, loc); 349 } 350 351 static u8 crb_status(struct tpm_chip *chip) 352 { 353 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 354 u8 sts = 0; 355 356 if ((ioread32(&priv->regs_t->ctrl_start) & CRB_START_INVOKE) != 357 CRB_START_INVOKE) 358 sts |= CRB_DRV_STS_COMPLETE; 359 360 return sts; 361 } 362 363 static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) 364 { 365 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 366 unsigned int expected; 367 368 /* A sanity check that the upper layer wants to get at least the header 369 * as that is the minimum size for any TPM response. 370 */ 371 if (count < TPM_HEADER_SIZE) 372 return -EIO; 373 374 /* If this bit is set, according to the spec, the TPM is in 375 * unrecoverable condition. 376 */ 377 if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR) 378 return -EIO; 379 380 /* Read the first 8 bytes in order to get the length of the response. 381 * We read exactly a quad word in order to make sure that the remaining 382 * reads will be aligned. 383 */ 384 memcpy_fromio(buf, priv->rsp, 8); 385 386 expected = be32_to_cpup((__be32 *)&buf[2]); 387 if (expected > count || expected < TPM_HEADER_SIZE) 388 return -EIO; 389 390 memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8); 391 392 return expected; 393 } 394 395 static int crb_do_acpi_start(struct tpm_chip *chip) 396 { 397 union acpi_object *obj; 398 int rc; 399 400 obj = acpi_evaluate_dsm(chip->acpi_dev_handle, 401 &crb_acpi_start_guid, 402 CRB_ACPI_START_REVISION_ID, 403 CRB_ACPI_START_INDEX, 404 NULL); 405 if (!obj) 406 return -ENXIO; 407 rc = obj->integer.value == 0 ? 0 : -ENXIO; 408 ACPI_FREE(obj); 409 return rc; 410 } 411 412 #ifdef CONFIG_ARM64 413 /* 414 * This is a TPM Command Response Buffer start method that invokes a 415 * Secure Monitor Call to requrest the firmware to execute or cancel 416 * a TPM 2.0 command. 417 */ 418 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id) 419 { 420 struct arm_smccc_res res; 421 422 arm_smccc_smc(func_id, 0, 0, 0, 0, 0, 0, 0, &res); 423 if (res.a0 != 0) { 424 dev_err(dev, 425 FW_BUG "tpm_crb_smc_start() returns res.a0 = 0x%lx\n", 426 res.a0); 427 return -EIO; 428 } 429 430 return 0; 431 } 432 #else 433 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id) 434 { 435 dev_err(dev, FW_BUG "tpm_crb: incorrect start method\n"); 436 return -EINVAL; 437 } 438 #endif 439 440 static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len) 441 { 442 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 443 int rc = 0; 444 445 /* Zero the cancel register so that the next command will not get 446 * canceled. 447 */ 448 iowrite32(0, &priv->regs_t->ctrl_cancel); 449 450 if (len > priv->cmd_size) { 451 dev_err(&chip->dev, "invalid command count value %zd %d\n", 452 len, priv->cmd_size); 453 return -E2BIG; 454 } 455 456 /* Seems to be necessary for every command */ 457 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) 458 __crb_cmd_ready(&chip->dev, priv, chip->locality); 459 460 memcpy_toio(priv->cmd, buf, len); 461 462 /* Make sure that cmd is populated before issuing start. */ 463 wmb(); 464 465 /* The reason for the extra quirk is that the PTT in 4th Gen Core CPUs 466 * report only ACPI start but in practice seems to require both 467 * CRB start, hence invoking CRB start method if hid == MSFT0101. 468 */ 469 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER || 470 priv->sm == ACPI_TPM2_MEMORY_MAPPED || 471 !strcmp(priv->hid, "MSFT0101")) 472 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 473 474 if (priv->sm == ACPI_TPM2_START_METHOD || 475 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) 476 rc = crb_do_acpi_start(chip); 477 478 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) { 479 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 480 rc = tpm_crb_smc_start(&chip->dev, priv->smc_func_id); 481 } 482 483 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 484 iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start); 485 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality); 486 } 487 488 if (rc) 489 return rc; 490 491 return crb_try_pluton_doorbell(priv, false); 492 } 493 494 static void crb_cancel(struct tpm_chip *chip) 495 { 496 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 497 int rc; 498 499 iowrite32(CRB_CANCEL_INVOKE, &priv->regs_t->ctrl_cancel); 500 501 if ((priv->sm == ACPI_TPM2_START_METHOD || 502 priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) && 503 crb_do_acpi_start(chip)) 504 dev_err(&chip->dev, "ACPI Start failed\n"); 505 506 if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 507 rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality); 508 if (rc) 509 dev_err(&chip->dev, "FF-A Start failed\n"); 510 } 511 } 512 513 static bool crb_req_canceled(struct tpm_chip *chip, u8 status) 514 { 515 struct crb_priv *priv = dev_get_drvdata(&chip->dev); 516 u32 cancel = ioread32(&priv->regs_t->ctrl_cancel); 517 518 return (cancel & CRB_CANCEL_INVOKE) == CRB_CANCEL_INVOKE; 519 } 520 521 static const struct tpm_class_ops tpm_crb = { 522 .flags = TPM_OPS_AUTO_STARTUP, 523 .status = crb_status, 524 .recv = crb_recv, 525 .send = crb_send, 526 .cancel = crb_cancel, 527 .req_canceled = crb_req_canceled, 528 .go_idle = crb_go_idle, 529 .cmd_ready = crb_cmd_ready, 530 .request_locality = crb_request_locality, 531 .relinquish_locality = crb_relinquish_locality, 532 .req_complete_mask = CRB_DRV_STS_COMPLETE, 533 .req_complete_val = CRB_DRV_STS_COMPLETE, 534 }; 535 536 static int crb_check_resource(struct acpi_resource *ares, void *data) 537 { 538 struct resource *iores_array = data; 539 struct resource_win win; 540 struct resource *res = &(win.res); 541 int i; 542 543 if (acpi_dev_resource_memory(ares, res) || 544 acpi_dev_resource_address_space(ares, &win)) { 545 for (i = 0; i < TPM_CRB_MAX_RESOURCES + 1; ++i) { 546 if (resource_type(iores_array + i) != IORESOURCE_MEM) { 547 iores_array[i] = *res; 548 iores_array[i].name = NULL; 549 break; 550 } 551 } 552 } 553 554 return 1; 555 } 556 557 static void __iomem *crb_map_res(struct device *dev, struct resource *iores, 558 void __iomem **iobase_ptr, u64 start, u32 size) 559 { 560 struct resource new_res = { 561 .start = start, 562 .end = start + size - 1, 563 .flags = IORESOURCE_MEM, 564 }; 565 566 /* Detect a 64 bit address on a 32 bit system */ 567 if (start != new_res.start) 568 return IOMEM_ERR_PTR(-EINVAL); 569 570 if (!iores) 571 return devm_ioremap_resource(dev, &new_res); 572 573 if (!*iobase_ptr) { 574 *iobase_ptr = devm_ioremap_resource(dev, iores); 575 if (IS_ERR(*iobase_ptr)) 576 return *iobase_ptr; 577 } 578 579 return *iobase_ptr + (new_res.start - iores->start); 580 } 581 582 /* 583 * Work around broken BIOSs that return inconsistent values from the ACPI 584 * region vs the registers. Trust the ACPI region. Such broken systems 585 * probably cannot send large TPM commands since the buffer will be truncated. 586 */ 587 static u64 crb_fixup_cmd_size(struct device *dev, struct resource *io_res, 588 u64 start, u64 size) 589 { 590 if (io_res->start > start || io_res->end < start) 591 return size; 592 593 if (start + size - 1 <= io_res->end) 594 return size; 595 596 dev_err(dev, 597 FW_BUG "ACPI region does not cover the entire command/response buffer. %pr vs %llx %llx\n", 598 io_res, start, size); 599 600 return io_res->end - start + 1; 601 } 602 603 static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, 604 struct acpi_table_tpm2 *buf) 605 { 606 struct list_head acpi_resource_list; 607 struct resource iores_array[TPM_CRB_MAX_RESOURCES + 1] = { {0} }; 608 void __iomem *iobase_array[TPM_CRB_MAX_RESOURCES] = {NULL}; 609 struct device *dev = &device->dev; 610 struct resource *iores; 611 void __iomem **iobase_ptr; 612 int i; 613 u32 pa_high, pa_low; 614 u64 cmd_pa; 615 u32 cmd_size; 616 __le64 __rsp_pa; 617 u64 rsp_pa; 618 u32 rsp_size; 619 int ret; 620 621 /* 622 * Pluton sometimes does not define ACPI memory regions. 623 * Mapping is then done in crb_map_pluton 624 */ 625 if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 626 INIT_LIST_HEAD(&acpi_resource_list); 627 ret = acpi_dev_get_resources(device, &acpi_resource_list, 628 crb_check_resource, iores_array); 629 if (ret < 0) 630 return ret; 631 acpi_dev_free_resource_list(&acpi_resource_list); 632 633 if (resource_type(iores_array) != IORESOURCE_MEM) { 634 dev_err(dev, FW_BUG "TPM2 ACPI table does not define a memory resource\n"); 635 return -EINVAL; 636 } else if (resource_type(iores_array + TPM_CRB_MAX_RESOURCES) == 637 IORESOURCE_MEM) { 638 dev_warn(dev, "TPM2 ACPI table defines too many memory resources\n"); 639 memset(iores_array + TPM_CRB_MAX_RESOURCES, 640 0, sizeof(*iores_array)); 641 iores_array[TPM_CRB_MAX_RESOURCES].flags = 0; 642 } 643 } 644 645 iores = NULL; 646 iobase_ptr = NULL; 647 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) { 648 if (buf->control_address >= iores_array[i].start && 649 buf->control_address + sizeof(struct crb_regs_tail) - 1 <= 650 iores_array[i].end) { 651 iores = iores_array + i; 652 iobase_ptr = iobase_array + i; 653 break; 654 } 655 } 656 657 priv->regs_t = crb_map_res(dev, iores, iobase_ptr, buf->control_address, 658 sizeof(struct crb_regs_tail)); 659 660 if (IS_ERR(priv->regs_t)) 661 return PTR_ERR(priv->regs_t); 662 663 /* The ACPI IO region starts at the head area and continues to include 664 * the control area, as one nice sane region except for some older 665 * stuff that puts the control area outside the ACPI IO region. 666 */ 667 if (priv->sm == ACPI_TPM2_COMMAND_BUFFER || 668 priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA || 669 priv->sm == ACPI_TPM2_MEMORY_MAPPED) { 670 if (iores && 671 buf->control_address == iores->start + 672 sizeof(*priv->regs_h)) 673 priv->regs_h = *iobase_ptr; 674 else 675 dev_warn(dev, FW_BUG "Bad ACPI memory layout"); 676 } 677 678 ret = __crb_request_locality(dev, priv, 0); 679 if (ret) 680 return ret; 681 682 /* 683 * PTT HW bug w/a: wake up the device to access 684 * possibly not retained registers. 685 */ 686 ret = __crb_cmd_ready(dev, priv, 0); 687 if (ret) 688 goto out_relinquish_locality; 689 690 pa_high = ioread32(&priv->regs_t->ctrl_cmd_pa_high); 691 pa_low = ioread32(&priv->regs_t->ctrl_cmd_pa_low); 692 cmd_pa = ((u64)pa_high << 32) | pa_low; 693 cmd_size = ioread32(&priv->regs_t->ctrl_cmd_size); 694 695 iores = NULL; 696 iobase_ptr = NULL; 697 for (i = 0; iores_array[i].end; ++i) { 698 if (cmd_pa >= iores_array[i].start && 699 cmd_pa <= iores_array[i].end) { 700 iores = iores_array + i; 701 iobase_ptr = iobase_array + i; 702 break; 703 } 704 } 705 706 if (iores) 707 cmd_size = crb_fixup_cmd_size(dev, iores, cmd_pa, cmd_size); 708 709 dev_dbg(dev, "cmd_hi = %X cmd_low = %X cmd_size %X\n", 710 pa_high, pa_low, cmd_size); 711 712 priv->cmd = crb_map_res(dev, iores, iobase_ptr, cmd_pa, cmd_size); 713 if (IS_ERR(priv->cmd)) { 714 ret = PTR_ERR(priv->cmd); 715 goto out; 716 } 717 718 memcpy_fromio(&__rsp_pa, &priv->regs_t->ctrl_rsp_pa, 8); 719 rsp_pa = le64_to_cpu(__rsp_pa); 720 rsp_size = ioread32(&priv->regs_t->ctrl_rsp_size); 721 722 iores = NULL; 723 iobase_ptr = NULL; 724 for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) { 725 if (rsp_pa >= iores_array[i].start && 726 rsp_pa <= iores_array[i].end) { 727 iores = iores_array + i; 728 iobase_ptr = iobase_array + i; 729 break; 730 } 731 } 732 733 if (iores) 734 rsp_size = crb_fixup_cmd_size(dev, iores, rsp_pa, rsp_size); 735 736 if (cmd_pa != rsp_pa) { 737 priv->rsp = crb_map_res(dev, iores, iobase_ptr, 738 rsp_pa, rsp_size); 739 ret = PTR_ERR_OR_ZERO(priv->rsp); 740 goto out; 741 } 742 743 /* According to the PTP specification, overlapping command and response 744 * buffer sizes must be identical. 745 */ 746 if (cmd_size != rsp_size) { 747 dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical"); 748 ret = -EINVAL; 749 goto out; 750 } 751 752 priv->rsp = priv->cmd; 753 754 out: 755 if (!ret) 756 priv->cmd_size = cmd_size; 757 758 __crb_go_idle(dev, priv, 0); 759 760 out_relinquish_locality: 761 762 __crb_relinquish_locality(dev, priv, 0); 763 764 return ret; 765 } 766 767 static int crb_map_pluton(struct device *dev, struct crb_priv *priv, 768 struct acpi_table_tpm2 *buf, struct tpm2_crb_pluton *crb_pluton) 769 { 770 priv->pluton_start_addr = crb_map_res(dev, NULL, NULL, 771 crb_pluton->start_addr, 4); 772 if (IS_ERR(priv->pluton_start_addr)) 773 return PTR_ERR(priv->pluton_start_addr); 774 775 priv->pluton_reply_addr = crb_map_res(dev, NULL, NULL, 776 crb_pluton->reply_addr, 4); 777 if (IS_ERR(priv->pluton_reply_addr)) 778 return PTR_ERR(priv->pluton_reply_addr); 779 780 return 0; 781 } 782 783 static int crb_acpi_add(struct acpi_device *device) 784 { 785 struct acpi_table_tpm2 *buf; 786 struct crb_priv *priv; 787 struct tpm_chip *chip; 788 struct device *dev = &device->dev; 789 struct tpm2_crb_smc *crb_smc; 790 struct tpm2_crb_ffa *crb_ffa; 791 struct tpm2_crb_pluton *crb_pluton; 792 acpi_status status; 793 u32 sm; 794 int rc; 795 796 status = acpi_get_table(ACPI_SIG_TPM2, 1, 797 (struct acpi_table_header **) &buf); 798 if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) { 799 dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n"); 800 return -EINVAL; 801 } 802 803 /* Should the FIFO driver handle this? */ 804 sm = buf->start_method; 805 if (sm == ACPI_TPM2_MEMORY_MAPPED) { 806 rc = -ENODEV; 807 goto out; 808 } 809 810 priv = devm_kzalloc(dev, sizeof(struct crb_priv), GFP_KERNEL); 811 if (!priv) { 812 rc = -ENOMEM; 813 goto out; 814 } 815 816 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) { 817 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_smc))) { 818 dev_err(dev, 819 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 820 buf->header.length, 821 ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC); 822 rc = -EINVAL; 823 goto out; 824 } 825 crb_smc = ACPI_ADD_PTR(struct tpm2_crb_smc, buf, sizeof(*buf)); 826 priv->smc_func_id = crb_smc->smc_func_id; 827 } 828 829 if (sm == ACPI_TPM2_CRB_WITH_ARM_FFA) { 830 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_ffa))) { 831 dev_err(dev, 832 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 833 buf->header.length, 834 ACPI_TPM2_CRB_WITH_ARM_FFA); 835 rc = -EINVAL; 836 goto out; 837 } 838 crb_ffa = ACPI_ADD_PTR(struct tpm2_crb_ffa, buf, sizeof(*buf)); 839 priv->ffa_flags = crb_ffa->flags; 840 priv->ffa_attributes = crb_ffa->attributes; 841 rc = tpm_crb_ffa_init(); 842 if (rc) { 843 /* If FF-A driver is not available yet, request probe retry */ 844 if (rc == -ENOENT) 845 rc = -EPROBE_DEFER; 846 goto out; 847 } 848 } 849 850 if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 851 if (buf->header.length < (sizeof(*buf) + sizeof(*crb_pluton))) { 852 dev_err(dev, 853 FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n", 854 buf->header.length, 855 ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON); 856 rc = -EINVAL; 857 goto out; 858 } 859 crb_pluton = ACPI_ADD_PTR(struct tpm2_crb_pluton, buf, sizeof(*buf)); 860 rc = crb_map_pluton(dev, priv, buf, crb_pluton); 861 if (rc) 862 goto out; 863 } 864 865 priv->sm = sm; 866 priv->hid = acpi_device_hid(device); 867 868 rc = crb_map_io(device, priv, buf); 869 if (rc) 870 goto out; 871 872 chip = tpmm_chip_alloc(dev, &tpm_crb); 873 if (IS_ERR(chip)) { 874 rc = PTR_ERR(chip); 875 goto out; 876 } 877 878 dev_set_drvdata(&chip->dev, priv); 879 chip->acpi_dev_handle = device->handle; 880 chip->flags = TPM_CHIP_FLAG_TPM2; 881 882 rc = tpm_chip_bootstrap(chip); 883 if (rc) 884 goto out; 885 886 #ifdef CONFIG_X86 887 /* A quirk for https://www.amd.com/en/support/kb/faq/pa-410 */ 888 if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD && 889 priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) { 890 dev_info(dev, "Disabling hwrng\n"); 891 chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED; 892 } 893 #endif /* CONFIG_X86 */ 894 895 rc = tpm_chip_register(chip); 896 897 out: 898 acpi_put_table((struct acpi_table_header *)buf); 899 return rc; 900 } 901 902 static void crb_acpi_remove(struct acpi_device *device) 903 { 904 struct device *dev = &device->dev; 905 struct tpm_chip *chip = dev_get_drvdata(dev); 906 907 tpm_chip_unregister(chip); 908 } 909 910 static const struct dev_pm_ops crb_pm = { 911 SET_SYSTEM_SLEEP_PM_OPS(tpm_pm_suspend, tpm_pm_resume) 912 }; 913 914 static const struct acpi_device_id crb_device_ids[] = { 915 {"MSFT0101", 0}, 916 {"", 0}, 917 }; 918 MODULE_DEVICE_TABLE(acpi, crb_device_ids); 919 920 static struct acpi_driver crb_acpi_driver = { 921 .name = "tpm_crb", 922 .ids = crb_device_ids, 923 .ops = { 924 .add = crb_acpi_add, 925 .remove = crb_acpi_remove, 926 }, 927 .drv = { 928 .pm = &crb_pm, 929 }, 930 }; 931 932 module_acpi_driver(crb_acpi_driver); 933 MODULE_AUTHOR("Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>"); 934 MODULE_DESCRIPTION("TPM2 Driver"); 935 MODULE_VERSION("0.1"); 936 MODULE_LICENSE("GPL"); 937