2 * Copyright (c) 2011 The Chromium OS Authors.
4 * SPDX-License-Identifier: GPL-2.0+
8 * The code in this file is based on the article "Writing a TPM Device Driver"
9 * published on http://ptgmedia.pearsoncmg.com.
11 * One principal difference is that in the simplest config the other than 0
12 * TPM localities do not get mapped by some devices (for instance, by Infineon
13 * slb9635), so this driver provides access to locality 0 only.
21 #define PREFIX "lpc_tpm: "
41 * This pointer refers to the TPM chip, 5 of its localities are mapped as an
44 #define TPM_TOTAL_LOCALITIES 5
45 static struct tpm_locality *lpc_tpm_dev =
46 (struct tpm_locality *)CONFIG_TPM_TIS_BASE_ADDRESS;
48 /* Some registers' bit field definitions */
49 #define TIS_STS_VALID (1 << 7) /* 0x80 */
50 #define TIS_STS_COMMAND_READY (1 << 6) /* 0x40 */
51 #define TIS_STS_TPM_GO (1 << 5) /* 0x20 */
52 #define TIS_STS_DATA_AVAILABLE (1 << 4) /* 0x10 */
53 #define TIS_STS_EXPECT (1 << 3) /* 0x08 */
54 #define TIS_STS_RESPONSE_RETRY (1 << 1) /* 0x02 */
56 #define TIS_ACCESS_TPM_REG_VALID_STS (1 << 7) /* 0x80 */
57 #define TIS_ACCESS_ACTIVE_LOCALITY (1 << 5) /* 0x20 */
58 #define TIS_ACCESS_BEEN_SEIZED (1 << 4) /* 0x10 */
59 #define TIS_ACCESS_SEIZE (1 << 3) /* 0x08 */
60 #define TIS_ACCESS_PENDING_REQUEST (1 << 2) /* 0x04 */
61 #define TIS_ACCESS_REQUEST_USE (1 << 1) /* 0x02 */
62 #define TIS_ACCESS_TPM_ESTABLISHMENT (1 << 0) /* 0x01 */
64 #define TIS_STS_BURST_COUNT_MASK (0xffff)
65 #define TIS_STS_BURST_COUNT_SHIFT (8)
68 * Error value returned if a tpm register does not enter the expected state
69 * after continuous polling. No actual TPM register reading ever returns -1,
70 * so this value is a safe error indication to be mixed with possible status
73 #define TPM_TIMEOUT_ERR (-1)
75 /* Error value returned on various TPM driver errors. */
76 #define TPM_DRIVER_ERR (1)
78 /* 1 second is plenty for anything TPM does. */
79 #define MAX_DELAY_US (1000 * 1000)
81 /* Retrieve burst count value out of the status register contents. */
82 static u16 burst_count(u32 status)
84 return (status >> TIS_STS_BURST_COUNT_SHIFT) & TIS_STS_BURST_COUNT_MASK;
88 * Structures defined below allow creating descriptions of TPM vendor/device
89 * ID information for run time discovery. The only device the system knows
90 * about at this time is Infineon slb9635.
94 const char * const dev_name;
99 const char *vendor_name;
100 const struct device_name *dev_names;
103 static const struct device_name infineon_devices[] = {
104 {0xb, "SLB9635 TT 1.2"},
108 static const struct vendor_name vendor_names[] = {
109 {0x15d1, "Infineon", infineon_devices},
113 * Cached vendor/device ID pair to indicate that the device has been already
116 static u32 vendor_dev_id;
118 /* TPM access wrappers to support tracing */
119 static u8 tpm_read_byte(const u8 *ptr)
122 debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n",
123 (u32)(uintptr_t)ptr - (u32)(uintptr_t)lpc_tpm_dev, ret);
127 static u32 tpm_read_word(const u32 *ptr)
129 u32 ret = readl(ptr);
130 debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n",
131 (u32)(uintptr_t)ptr - (u32)(uintptr_t)lpc_tpm_dev, ret);
135 static void tpm_write_byte(u8 value, u8 *ptr)
137 debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n",
138 (u32)(uintptr_t)ptr - (u32)(uintptr_t)lpc_tpm_dev, value);
142 static void tpm_write_word(u32 value, u32 *ptr)
144 debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n",
145 (u32)(uintptr_t)ptr - (u32)(uintptr_t)lpc_tpm_dev, value);
152 * Wait for at least a second for a register to change its state to match the
153 * expected state. Normally the transition happens within microseconds.
155 * @reg - pointer to the TPM register
156 * @mask - bitmask for the bitfield(s) to watch
157 * @expected - value the field(s) are supposed to be set to
159 * Returns the register contents in case the expected value was found in the
160 * appropriate register bits, or TPM_TIMEOUT_ERR on timeout.
162 static u32 tis_wait_reg(u32 *reg, u8 mask, u8 expected)
164 u32 time_us = MAX_DELAY_US;
166 while (time_us > 0) {
167 u32 value = tpm_read_word(reg);
168 if ((value & mask) == expected)
170 udelay(1); /* 1 us */
173 return TPM_TIMEOUT_ERR;
177 * Probe the TPM device and try determining its manufacturer/device name.
179 * Returns 0 on success (the device is found or was found during an earlier
180 * invocation) or TPM_DRIVER_ERR if the device is not found.
184 u32 didvid = tpm_read_word(&lpc_tpm_dev[0].did_vid);
186 const char *device_name = "unknown";
187 const char *vendor_name = device_name;
191 return 0; /* Already probed. */
193 if (!didvid || (didvid == 0xffffffff)) {
194 printf("%s: No TPM device found\n", __func__);
195 return TPM_DRIVER_ERR;
198 vendor_dev_id = didvid;
200 vid = didvid & 0xffff;
201 did = (didvid >> 16) & 0xffff;
202 for (i = 0; i < ARRAY_SIZE(vendor_names); i++) {
206 if (vid == vendor_names[i].vendor_id)
207 vendor_name = vendor_names[i].vendor_name;
209 while ((known_did = vendor_names[i].dev_names[j].dev_id) != 0) {
210 if (known_did == did) {
212 vendor_names[i].dev_names[j].dev_name;
220 printf("Found TPM %s by %s\n", device_name, vendor_name);
227 * send the passed in data to the TPM device.
229 * @data - address of the data to send, byte by byte
230 * @len - length of the data to send
232 * Returns 0 on success, TPM_DRIVER_ERR on error (in case the device does
233 * not accept the entire command).
235 static u32 tis_senddata(const u8 * const data, u32 len)
243 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
244 TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY);
245 if (value == TPM_TIMEOUT_ERR) {
246 printf("%s:%d - failed to get 'command_ready' status\n",
248 return TPM_DRIVER_ERR;
250 burst = burst_count(value);
255 /* Wait till the device is ready to accept more data. */
257 if (max_cycles++ == MAX_DELAY_US) {
258 printf("%s:%d failed to feed %d bytes of %d\n",
259 __FILE__, __LINE__, len - offset, len);
260 return TPM_DRIVER_ERR;
263 burst = burst_count(tpm_read_word(&lpc_tpm_dev
264 [locality].tpm_status));
270 * Calculate number of bytes the TPM is ready to accept in one
273 * We want to send the last byte outside of the loop (hence
274 * the -1 below) to make sure that the 'expected' status bit
275 * changes to zero exactly after the last byte is fed into the
278 count = min((u32)burst, len - offset - 1);
280 tpm_write_byte(data[offset++],
281 &lpc_tpm_dev[locality].data);
283 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
284 TIS_STS_VALID, TIS_STS_VALID);
286 if ((value == TPM_TIMEOUT_ERR) || !(value & TIS_STS_EXPECT)) {
287 printf("%s:%d TPM command feed overflow\n",
289 return TPM_DRIVER_ERR;
292 burst = burst_count(value);
293 if ((offset == (len - 1)) && burst) {
295 * We need to be able to send the last byte to the
296 * device, so burst size must be nonzero before we
303 /* Send the last byte. */
304 tpm_write_byte(data[offset++], &lpc_tpm_dev[locality].data);
306 * Verify that TPM does not expect any more data as part of this
309 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
310 TIS_STS_VALID, TIS_STS_VALID);
311 if ((value == TPM_TIMEOUT_ERR) || (value & TIS_STS_EXPECT)) {
312 printf("%s:%d unexpected TPM status 0x%x\n",
313 __FILE__, __LINE__, value);
314 return TPM_DRIVER_ERR;
317 /* OK, sitting pretty, let's start the command execution. */
318 tpm_write_word(TIS_STS_TPM_GO, &lpc_tpm_dev[locality].tpm_status);
325 * read the TPM device response after a command was issued.
327 * @buffer - address where to read the response, byte by byte.
328 * @len - pointer to the size of buffer
330 * On success stores the number of received bytes to len and returns 0. On
331 * errors (misformatted TPM data or synchronization problems) returns
334 static u32 tis_readresponse(u8 *buffer, u32 *len)
340 const u32 has_data = TIS_STS_DATA_AVAILABLE | TIS_STS_VALID;
341 u32 expected_count = *len;
344 /* Wait for the TPM to process the command. */
345 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
347 if (value == TPM_TIMEOUT_ERR) {
348 printf("%s:%d failed processing command\n",
350 return TPM_DRIVER_ERR;
354 while ((burst = burst_count(value)) == 0) {
355 if (max_cycles++ == MAX_DELAY_US) {
356 printf("%s:%d TPM stuck on read\n",
358 return TPM_DRIVER_ERR;
361 value = tpm_read_word(&lpc_tpm_dev
362 [locality].tpm_status);
367 while (burst-- && (offset < expected_count)) {
368 buffer[offset++] = tpm_read_byte(&lpc_tpm_dev
373 * We got the first six bytes of the reply,
374 * let's figure out how many bytes to expect
375 * total - it is stored as a 4 byte number in
376 * network order, starting with offset 2 into
377 * the body of the reply.
382 sizeof(real_length));
383 expected_count = be32_to_cpu(real_length);
385 if ((expected_count < offset) ||
386 (expected_count > *len)) {
387 printf("%s:%d bad response size %d\n",
390 return TPM_DRIVER_ERR;
395 /* Wait for the next portion. */
396 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
397 TIS_STS_VALID, TIS_STS_VALID);
398 if (value == TPM_TIMEOUT_ERR) {
399 printf("%s:%d failed to read response\n",
401 return TPM_DRIVER_ERR;
404 if (offset == expected_count)
405 break; /* We got all we needed. */
407 } while ((value & has_data) == has_data);
410 * Make sure we indeed read all there was. The TIS_STS_VALID bit is
413 if (value & TIS_STS_DATA_AVAILABLE) {
414 printf("%s:%d wrong receive status %x\n",
415 __FILE__, __LINE__, value);
416 return TPM_DRIVER_ERR;
419 /* Tell the TPM that we are done. */
420 tpm_write_word(TIS_STS_COMMAND_READY, &lpc_tpm_dev
421 [locality].tpm_status);
428 u8 locality = 0; /* we use locality zero for everything. */
430 /* now request access to locality. */
431 tpm_write_word(TIS_ACCESS_REQUEST_USE, &lpc_tpm_dev[locality].access);
433 /* did we get a lock? */
434 if (tis_wait_reg(&lpc_tpm_dev[locality].access,
435 TIS_ACCESS_ACTIVE_LOCALITY,
436 TIS_ACCESS_ACTIVE_LOCALITY) == TPM_TIMEOUT_ERR) {
437 printf("%s:%d - failed to lock locality %d\n",
438 __FILE__, __LINE__, locality);
439 return TPM_DRIVER_ERR;
442 tpm_write_word(TIS_STS_COMMAND_READY,
443 &lpc_tpm_dev[locality].tpm_status);
451 if (tpm_read_word(&lpc_tpm_dev[locality].access) &
452 TIS_ACCESS_ACTIVE_LOCALITY) {
453 tpm_write_word(TIS_ACCESS_ACTIVE_LOCALITY,
454 &lpc_tpm_dev[locality].access);
456 if (tis_wait_reg(&lpc_tpm_dev[locality].access,
457 TIS_ACCESS_ACTIVE_LOCALITY, 0) ==
459 printf("%s:%d - failed to release locality %d\n",
460 __FILE__, __LINE__, locality);
461 return TPM_DRIVER_ERR;
467 int tis_sendrecv(const u8 *sendbuf, size_t send_size,
468 u8 *recvbuf, size_t *recv_len)
470 if (tis_senddata(sendbuf, send_size)) {
471 printf("%s:%d failed sending data to TPM\n",
473 return TPM_DRIVER_ERR;
476 return tis_readresponse(recvbuf, (u32 *)recv_len);