1 /* 2 * Description: 3 * Device Driver for the Infineon Technologies 4 * SLD 9630 TT 1.1 and SLB 9635 TT 1.2 Trusted Platform Module 5 * Specifications at www.trustedcomputinggroup.org 6 * 7 * Copyright (C) 2005, Marcel Selhorst <selhorst@crypto.rub.de> 8 * Applied Data Security Group, Ruhr-University Bochum, Germany 9 * Project-Homepage: http://www.prosec.rub.de/tpm 10 * 11 * This program is free software; you can redistribute it and/or 12 * modify it under the terms of the GNU General Public License as 13 * published by the Free Software Foundation, version 2 of the 14 * License. 15 */ 16 17 #include <linux/pnp.h> 18 #include "tpm.h" 19 20 /* Infineon specific definitions */ 21 /* maximum number of WTX-packages */ 22 #define TPM_MAX_WTX_PACKAGES 50 23 /* msleep-Time for WTX-packages */ 24 #define TPM_WTX_MSLEEP_TIME 20 25 /* msleep-Time --> Interval to check status register */ 26 #define TPM_MSLEEP_TIME 3 27 /* gives number of max. msleep()-calls before throwing timeout */ 28 #define TPM_MAX_TRIES 5000 29 #define TPM_INFINEON_DEV_VEN_VALUE 0x15D1 30 31 /* These values will be filled after PnP-call */ 32 static int TPM_INF_DATA = 0; 33 static int TPM_INF_ADDR = 0; 34 static int pnp_registered = 0; 35 36 /* TPM header definitions */ 37 enum infineon_tpm_header { 38 TPM_VL_VER = 0x01, 39 TPM_VL_CHANNEL_CONTROL = 0x07, 40 TPM_VL_CHANNEL_PERSONALISATION = 0x0A, 41 TPM_VL_CHANNEL_TPM = 0x0B, 42 TPM_VL_CONTROL = 0x00, 43 TPM_INF_NAK = 0x15, 44 TPM_CTRL_WTX = 0x10, 45 TPM_CTRL_WTX_ABORT = 0x18, 46 TPM_CTRL_WTX_ABORT_ACK = 0x18, 47 TPM_CTRL_ERROR = 0x20, 48 TPM_CTRL_CHAININGACK = 0x40, 49 TPM_CTRL_CHAINING = 0x80, 50 TPM_CTRL_DATA = 0x04, 51 TPM_CTRL_DATA_CHA = 0x84, 52 TPM_CTRL_DATA_CHA_ACK = 0xC4 53 }; 54 55 enum infineon_tpm_register { 56 WRFIFO = 0x00, 57 RDFIFO = 0x01, 58 STAT = 0x02, 59 CMD = 0x03 60 }; 61 62 enum infineon_tpm_command_bits { 63 CMD_DIS = 0x00, 64 CMD_LP = 0x01, 65 CMD_RES = 0x02, 66 CMD_IRQC = 0x06 67 }; 68 69 enum infineon_tpm_status_bits { 70 STAT_XFE = 0x00, 71 STAT_LPA = 0x01, 72 STAT_FOK = 0x02, 73 STAT_TOK = 0x03, 74 STAT_IRQA = 0x06, 75 STAT_RDA = 0x07 76 }; 77 78 /* some outgoing values */ 79 enum infineon_tpm_values { 80 CHIP_ID1 = 0x20, 81 CHIP_ID2 = 0x21, 82 TPM_DAR = 0x30, 83 RESET_LP_IRQC_DISABLE = 0x41, 84 ENABLE_REGISTER_PAIR = 0x55, 85 IOLIMH = 0x60, 86 IOLIML = 0x61, 87 DISABLE_REGISTER_PAIR = 0xAA, 88 IDVENL = 0xF1, 89 IDVENH = 0xF2, 90 IDPDL = 0xF3, 91 IDPDH = 0xF4 92 }; 93 94 static int number_of_wtx; 95 96 static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo) 97 { 98 int status; 99 int check = 0; 100 int i; 101 102 if (clear_wrfifo) { 103 for (i = 0; i < 4096; i++) { 104 status = inb(chip->vendor->base + WRFIFO); 105 if (status == 0xff) { 106 if (check == 5) 107 break; 108 else 109 check++; 110 } 111 } 112 } 113 /* Note: The values which are currently in the FIFO of the TPM 114 are thrown away since there is no usage for them. Usually, 115 this has nothing to say, since the TPM will give its answer 116 immediately or will be aborted anyway, so the data here is 117 usually garbage and useless. 118 We have to clean this, because the next communication with 119 the TPM would be rubbish, if there is still some old data 120 in the Read FIFO. 121 */ 122 i = 0; 123 do { 124 status = inb(chip->vendor->base + RDFIFO); 125 status = inb(chip->vendor->base + STAT); 126 i++; 127 if (i == TPM_MAX_TRIES) 128 return -EIO; 129 } while ((status & (1 << STAT_RDA)) != 0); 130 return 0; 131 } 132 133 static int wait(struct tpm_chip *chip, int wait_for_bit) 134 { 135 int status; 136 int i; 137 for (i = 0; i < TPM_MAX_TRIES; i++) { 138 status = inb(chip->vendor->base + STAT); 139 /* check the status-register if wait_for_bit is set */ 140 if (status & 1 << wait_for_bit) 141 break; 142 msleep(TPM_MSLEEP_TIME); 143 } 144 if (i == TPM_MAX_TRIES) { /* timeout occurs */ 145 if (wait_for_bit == STAT_XFE) 146 dev_err(&chip->pci_dev->dev, 147 "Timeout in wait(STAT_XFE)\n"); 148 if (wait_for_bit == STAT_RDA) 149 dev_err(&chip->pci_dev->dev, 150 "Timeout in wait(STAT_RDA)\n"); 151 return -EIO; 152 } 153 return 0; 154 }; 155 156 static void wait_and_send(struct tpm_chip *chip, u8 sendbyte) 157 { 158 wait(chip, STAT_XFE); 159 outb(sendbyte, chip->vendor->base + WRFIFO); 160 } 161 162 /* Note: WTX means Waiting-Time-Extension. Whenever the TPM needs more 163 calculation time, it sends a WTX-package, which has to be acknowledged 164 or aborted. This usually occurs if you are hammering the TPM with key 165 creation. Set the maximum number of WTX-packages in the definitions 166 above, if the number is reached, the waiting-time will be denied 167 and the TPM command has to be resend. 168 */ 169 170 static void tpm_wtx(struct tpm_chip *chip) 171 { 172 number_of_wtx++; 173 dev_info(&chip->pci_dev->dev, "Granting WTX (%02d / %02d)\n", 174 number_of_wtx, TPM_MAX_WTX_PACKAGES); 175 wait_and_send(chip, TPM_VL_VER); 176 wait_and_send(chip, TPM_CTRL_WTX); 177 wait_and_send(chip, 0x00); 178 wait_and_send(chip, 0x00); 179 msleep(TPM_WTX_MSLEEP_TIME); 180 } 181 182 static void tpm_wtx_abort(struct tpm_chip *chip) 183 { 184 dev_info(&chip->pci_dev->dev, "Aborting WTX\n"); 185 wait_and_send(chip, TPM_VL_VER); 186 wait_and_send(chip, TPM_CTRL_WTX_ABORT); 187 wait_and_send(chip, 0x00); 188 wait_and_send(chip, 0x00); 189 number_of_wtx = 0; 190 msleep(TPM_WTX_MSLEEP_TIME); 191 } 192 193 static int tpm_inf_recv(struct tpm_chip *chip, u8 * buf, size_t count) 194 { 195 int i; 196 int ret; 197 u32 size = 0; 198 199 recv_begin: 200 /* start receiving header */ 201 for (i = 0; i < 4; i++) { 202 ret = wait(chip, STAT_RDA); 203 if (ret) 204 return -EIO; 205 buf[i] = inb(chip->vendor->base + RDFIFO); 206 } 207 208 if (buf[0] != TPM_VL_VER) { 209 dev_err(&chip->pci_dev->dev, 210 "Wrong transport protocol implementation!\n"); 211 return -EIO; 212 } 213 214 if (buf[1] == TPM_CTRL_DATA) { 215 /* size of the data received */ 216 size = ((buf[2] << 8) | buf[3]); 217 218 for (i = 0; i < size; i++) { 219 wait(chip, STAT_RDA); 220 buf[i] = inb(chip->vendor->base + RDFIFO); 221 } 222 223 if ((size == 0x6D00) && (buf[1] == 0x80)) { 224 dev_err(&chip->pci_dev->dev, 225 "Error handling on vendor layer!\n"); 226 return -EIO; 227 } 228 229 for (i = 0; i < size; i++) 230 buf[i] = buf[i + 6]; 231 232 size = size - 6; 233 return size; 234 } 235 236 if (buf[1] == TPM_CTRL_WTX) { 237 dev_info(&chip->pci_dev->dev, "WTX-package received\n"); 238 if (number_of_wtx < TPM_MAX_WTX_PACKAGES) { 239 tpm_wtx(chip); 240 goto recv_begin; 241 } else { 242 tpm_wtx_abort(chip); 243 goto recv_begin; 244 } 245 } 246 247 if (buf[1] == TPM_CTRL_WTX_ABORT_ACK) { 248 dev_info(&chip->pci_dev->dev, "WTX-abort acknowledged\n"); 249 return size; 250 } 251 252 if (buf[1] == TPM_CTRL_ERROR) { 253 dev_err(&chip->pci_dev->dev, "ERROR-package received:\n"); 254 if (buf[4] == TPM_INF_NAK) 255 dev_err(&chip->pci_dev->dev, 256 "-> Negative acknowledgement" 257 " - retransmit command!\n"); 258 return -EIO; 259 } 260 return -EIO; 261 } 262 263 static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count) 264 { 265 int i; 266 int ret; 267 u8 count_high, count_low, count_4, count_3, count_2, count_1; 268 269 /* Disabling Reset, LP and IRQC */ 270 outb(RESET_LP_IRQC_DISABLE, chip->vendor->base + CMD); 271 272 ret = empty_fifo(chip, 1); 273 if (ret) { 274 dev_err(&chip->pci_dev->dev, "Timeout while clearing FIFO\n"); 275 return -EIO; 276 } 277 278 ret = wait(chip, STAT_XFE); 279 if (ret) 280 return -EIO; 281 282 count_4 = (count & 0xff000000) >> 24; 283 count_3 = (count & 0x00ff0000) >> 16; 284 count_2 = (count & 0x0000ff00) >> 8; 285 count_1 = (count & 0x000000ff); 286 count_high = ((count + 6) & 0xffffff00) >> 8; 287 count_low = ((count + 6) & 0x000000ff); 288 289 /* Sending Header */ 290 wait_and_send(chip, TPM_VL_VER); 291 wait_and_send(chip, TPM_CTRL_DATA); 292 wait_and_send(chip, count_high); 293 wait_and_send(chip, count_low); 294 295 /* Sending Data Header */ 296 wait_and_send(chip, TPM_VL_VER); 297 wait_and_send(chip, TPM_VL_CHANNEL_TPM); 298 wait_and_send(chip, count_4); 299 wait_and_send(chip, count_3); 300 wait_and_send(chip, count_2); 301 wait_and_send(chip, count_1); 302 303 /* Sending Data */ 304 for (i = 0; i < count; i++) { 305 wait_and_send(chip, buf[i]); 306 } 307 return count; 308 } 309 310 static void tpm_inf_cancel(struct tpm_chip *chip) 311 { 312 /* 313 Since we are using the legacy mode to communicate 314 with the TPM, we have no cancel functions, but have 315 a workaround for interrupting the TPM through WTX. 316 */ 317 } 318 319 static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL); 320 static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL); 321 static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL); 322 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel); 323 324 static struct attribute *inf_attrs[] = { 325 &dev_attr_pubek.attr, 326 &dev_attr_pcrs.attr, 327 &dev_attr_caps.attr, 328 &dev_attr_cancel.attr, 329 NULL, 330 }; 331 332 static struct attribute_group inf_attr_grp = {.attrs = inf_attrs }; 333 334 static struct file_operations inf_ops = { 335 .owner = THIS_MODULE, 336 .llseek = no_llseek, 337 .open = tpm_open, 338 .read = tpm_read, 339 .write = tpm_write, 340 .release = tpm_release, 341 }; 342 343 static struct tpm_vendor_specific tpm_inf = { 344 .recv = tpm_inf_recv, 345 .send = tpm_inf_send, 346 .cancel = tpm_inf_cancel, 347 .req_complete_mask = 0, 348 .req_complete_val = 0, 349 .attr_group = &inf_attr_grp, 350 .miscdev = {.fops = &inf_ops,}, 351 }; 352 353 static const struct pnp_device_id tpm_pnp_tbl[] = { 354 /* Infineon TPMs */ 355 {"IFX0101", 0}, 356 {"IFX0102", 0}, 357 {"", 0} 358 }; 359 MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl); 360 361 static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev, 362 const struct pnp_device_id *dev_id) 363 { 364 if (pnp_port_valid(dev, 0)) { 365 TPM_INF_ADDR = (pnp_port_start(dev, 0) & 0xff); 366 TPM_INF_DATA = ((TPM_INF_ADDR + 1) & 0xff); 367 tpm_inf.base = pnp_port_start(dev, 1); 368 dev_info(&dev->dev, "Found %s with ID %s\n", 369 dev->name, dev_id->id); 370 return 0; 371 } 372 return -ENODEV; 373 } 374 375 static struct pnp_driver tpm_inf_pnp = { 376 .name = "tpm_inf_pnp", 377 .id_table = tpm_pnp_tbl, 378 .probe = tpm_inf_pnp_probe, 379 }; 380 381 static int __devinit tpm_inf_probe(struct pci_dev *pci_dev, 382 const struct pci_device_id *pci_id) 383 { 384 int rc = 0; 385 u8 iol, ioh; 386 int vendorid[2]; 387 int version[2]; 388 int productid[2]; 389 char chipname[20]; 390 391 rc = pci_enable_device(pci_dev); 392 if (rc) 393 return rc; 394 395 dev_info(&pci_dev->dev, "LPC-bus found at 0x%x\n", pci_id->device); 396 397 /* read IO-ports from PnP */ 398 rc = pnp_register_driver(&tpm_inf_pnp); 399 if (rc < 0) { 400 dev_err(&pci_dev->dev, 401 "Error %x from pnp_register_driver!\n",rc); 402 goto error2; 403 } 404 if (!rc) { 405 dev_info(&pci_dev->dev, "No Infineon TPM found!\n"); 406 goto error; 407 } else { 408 pnp_registered = 1; 409 } 410 411 /* Make sure, we have received valid config ports */ 412 if (!TPM_INF_ADDR) { 413 dev_err(&pci_dev->dev, "No valid IO-ports received!\n"); 414 goto error; 415 } 416 417 /* query chip for its vendor, its version number a.s.o. */ 418 outb(ENABLE_REGISTER_PAIR, TPM_INF_ADDR); 419 outb(IDVENL, TPM_INF_ADDR); 420 vendorid[1] = inb(TPM_INF_DATA); 421 outb(IDVENH, TPM_INF_ADDR); 422 vendorid[0] = inb(TPM_INF_DATA); 423 outb(IDPDL, TPM_INF_ADDR); 424 productid[1] = inb(TPM_INF_DATA); 425 outb(IDPDH, TPM_INF_ADDR); 426 productid[0] = inb(TPM_INF_DATA); 427 outb(CHIP_ID1, TPM_INF_ADDR); 428 version[1] = inb(TPM_INF_DATA); 429 outb(CHIP_ID2, TPM_INF_ADDR); 430 version[0] = inb(TPM_INF_DATA); 431 432 switch ((productid[0] << 8) | productid[1]) { 433 case 6: 434 snprintf(chipname, sizeof(chipname), " (SLD 9630 TT 1.1)"); 435 break; 436 case 11: 437 snprintf(chipname, sizeof(chipname), " (SLB 9635 TT 1.2)"); 438 break; 439 default: 440 snprintf(chipname, sizeof(chipname), " (unknown chip)"); 441 break; 442 } 443 444 if ((vendorid[0] << 8 | vendorid[1]) == (TPM_INFINEON_DEV_VEN_VALUE)) { 445 446 if (tpm_inf.base == 0) { 447 dev_err(&pci_dev->dev, "No IO-ports found!\n"); 448 goto error; 449 } 450 /* configure TPM with IO-ports */ 451 outb(IOLIMH, TPM_INF_ADDR); 452 outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA); 453 outb(IOLIML, TPM_INF_ADDR); 454 outb((tpm_inf.base & 0xff), TPM_INF_DATA); 455 456 /* control if IO-ports are set correctly */ 457 outb(IOLIMH, TPM_INF_ADDR); 458 ioh = inb(TPM_INF_DATA); 459 outb(IOLIML, TPM_INF_ADDR); 460 iol = inb(TPM_INF_DATA); 461 462 if ((ioh << 8 | iol) != tpm_inf.base) { 463 dev_err(&pci_dev->dev, 464 "Could not set IO-ports to %04x\n", 465 tpm_inf.base); 466 goto error; 467 } 468 469 /* activate register */ 470 outb(TPM_DAR, TPM_INF_ADDR); 471 outb(0x01, TPM_INF_DATA); 472 outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR); 473 474 /* disable RESET, LP and IRQC */ 475 outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD); 476 477 /* Finally, we're done, print some infos */ 478 dev_info(&pci_dev->dev, "TPM found: " 479 "config base 0x%x, " 480 "io base 0x%x, " 481 "chip version %02x%02x, " 482 "vendor id %x%x (Infineon), " 483 "product id %02x%02x" 484 "%s\n", 485 TPM_INF_ADDR, 486 tpm_inf.base, 487 version[0], version[1], 488 vendorid[0], vendorid[1], 489 productid[0], productid[1], chipname); 490 491 rc = tpm_register_hardware(pci_dev, &tpm_inf); 492 if (rc < 0) 493 goto error; 494 return 0; 495 } else { 496 dev_info(&pci_dev->dev, "No Infineon TPM found!\n"); 497 error: 498 pnp_unregister_driver(&tpm_inf_pnp); 499 error2: 500 pci_disable_device(pci_dev); 501 pnp_registered = 0; 502 return -ENODEV; 503 } 504 } 505 506 static struct pci_device_id tpm_pci_tbl[] __devinitdata = { 507 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801BA_0)}, 508 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801CA_12)}, 509 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_0)}, 510 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_12)}, 511 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801EB_0)}, 512 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_0)}, 513 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_1)}, 514 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_2)}, 515 {0,} 516 }; 517 518 MODULE_DEVICE_TABLE(pci, tpm_pci_tbl); 519 520 static struct pci_driver inf_pci_driver = { 521 .name = "tpm_inf", 522 .id_table = tpm_pci_tbl, 523 .probe = tpm_inf_probe, 524 .remove = __devexit_p(tpm_remove), 525 .suspend = tpm_pm_suspend, 526 .resume = tpm_pm_resume, 527 }; 528 529 static int __init init_inf(void) 530 { 531 return pci_register_driver(&inf_pci_driver); 532 } 533 534 static void __exit cleanup_inf(void) 535 { 536 if (pnp_registered) 537 pnp_unregister_driver(&tpm_inf_pnp); 538 pci_unregister_driver(&inf_pci_driver); 539 } 540 541 module_init(init_inf); 542 module_exit(cleanup_inf); 543 544 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>"); 545 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2"); 546 MODULE_VERSION("1.5"); 547 MODULE_LICENSE("GPL"); 548