2 * Copyright (c) 2011 The Chromium OS Authors.
4 * See file CREDITS for list of people who contributed to this
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 of
10 * the License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
24 * The code in this file is based on the article "Writing a TPM Device Driver"
25 * published on http://ptgmedia.pearsoncmg.com.
27 * One principal difference is that in the simplest config the other than 0
28 * TPM localities do not get mapped by some devices (for instance, by Infineon
29 * slb9635), so this driver provides access to locality 0 only.
36 #define PREFIX "lpc_tpm: "
56 * This pointer refers to the TPM chip, 5 of its localities are mapped as an
59 #define TPM_TOTAL_LOCALITIES 5
60 static struct tpm_locality *lpc_tpm_dev =
61 (struct tpm_locality *)CONFIG_TPM_TIS_BASE_ADDRESS;
63 /* Some registers' bit field definitions */
64 #define TIS_STS_VALID (1 << 7) /* 0x80 */
65 #define TIS_STS_COMMAND_READY (1 << 6) /* 0x40 */
66 #define TIS_STS_TPM_GO (1 << 5) /* 0x20 */
67 #define TIS_STS_DATA_AVAILABLE (1 << 4) /* 0x10 */
68 #define TIS_STS_EXPECT (1 << 3) /* 0x08 */
69 #define TIS_STS_RESPONSE_RETRY (1 << 1) /* 0x02 */
71 #define TIS_ACCESS_TPM_REG_VALID_STS (1 << 7) /* 0x80 */
72 #define TIS_ACCESS_ACTIVE_LOCALITY (1 << 5) /* 0x20 */
73 #define TIS_ACCESS_BEEN_SEIZED (1 << 4) /* 0x10 */
74 #define TIS_ACCESS_SEIZE (1 << 3) /* 0x08 */
75 #define TIS_ACCESS_PENDING_REQUEST (1 << 2) /* 0x04 */
76 #define TIS_ACCESS_REQUEST_USE (1 << 1) /* 0x02 */
77 #define TIS_ACCESS_TPM_ESTABLISHMENT (1 << 0) /* 0x01 */
79 #define TIS_STS_BURST_COUNT_MASK (0xffff)
80 #define TIS_STS_BURST_COUNT_SHIFT (8)
83 * Error value returned if a tpm register does not enter the expected state
84 * after continuous polling. No actual TPM register reading ever returns -1,
85 * so this value is a safe error indication to be mixed with possible status
88 #define TPM_TIMEOUT_ERR (-1)
90 /* Error value returned on various TPM driver errors. */
91 #define TPM_DRIVER_ERR (1)
93 /* 1 second is plenty for anything TPM does. */
94 #define MAX_DELAY_US (1000 * 1000)
96 /* Retrieve burst count value out of the status register contents. */
97 static u16 burst_count(u32 status)
99 return (status >> TIS_STS_BURST_COUNT_SHIFT) & TIS_STS_BURST_COUNT_MASK;
103 * Structures defined below allow creating descriptions of TPM vendor/device
104 * ID information for run time discovery. The only device the system knows
105 * about at this time is Infineon slb9635.
109 const char * const dev_name;
114 const char *vendor_name;
115 const struct device_name *dev_names;
118 static const struct device_name infineon_devices[] = {
119 {0xb, "SLB9635 TT 1.2"},
123 static const struct vendor_name vendor_names[] = {
124 {0x15d1, "Infineon", infineon_devices},
128 * Cached vendor/device ID pair to indicate that the device has been already
131 static u32 vendor_dev_id;
133 /* TPM access wrappers to support tracing */
134 static u8 tpm_read_byte(const u8 *ptr)
137 debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n",
138 (u32)ptr - (u32)lpc_tpm_dev, ret);
142 static u32 tpm_read_word(const u32 *ptr)
144 u32 ret = readl(ptr);
145 debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n",
146 (u32)ptr - (u32)lpc_tpm_dev, ret);
150 static void tpm_write_byte(u8 value, u8 *ptr)
152 debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n",
153 (u32)ptr - (u32)lpc_tpm_dev, value);
157 static void tpm_write_word(u32 value, u32 *ptr)
159 debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n",
160 (u32)ptr - (u32)lpc_tpm_dev, value);
167 * Wait for at least a second for a register to change its state to match the
168 * expected state. Normally the transition happens within microseconds.
170 * @reg - pointer to the TPM register
171 * @mask - bitmask for the bitfield(s) to watch
172 * @expected - value the field(s) are supposed to be set to
174 * Returns the register contents in case the expected value was found in the
175 * appropriate register bits, or TPM_TIMEOUT_ERR on timeout.
177 static u32 tis_wait_reg(u32 *reg, u8 mask, u8 expected)
179 u32 time_us = MAX_DELAY_US;
181 while (time_us > 0) {
182 u32 value = tpm_read_word(reg);
183 if ((value & mask) == expected)
185 udelay(1); /* 1 us */
188 return TPM_TIMEOUT_ERR;
192 * Probe the TPM device and try determining its manufacturer/device name.
194 * Returns 0 on success (the device is found or was found during an earlier
195 * invocation) or TPM_DRIVER_ERR if the device is not found.
199 u32 didvid = tpm_read_word(&lpc_tpm_dev[0].did_vid);
201 const char *device_name = "unknown";
202 const char *vendor_name = device_name;
206 return 0; /* Already probed. */
208 if (!didvid || (didvid == 0xffffffff)) {
209 printf("%s: No TPM device found\n", __func__);
210 return TPM_DRIVER_ERR;
213 vendor_dev_id = didvid;
215 vid = didvid & 0xffff;
216 did = (didvid >> 16) & 0xffff;
217 for (i = 0; i < ARRAY_SIZE(vendor_names); i++) {
221 if (vid == vendor_names[i].vendor_id)
222 vendor_name = vendor_names[i].vendor_name;
224 while ((known_did = vendor_names[i].dev_names[j].dev_id) != 0) {
225 if (known_did == did) {
227 vendor_names[i].dev_names[j].dev_name;
235 printf("Found TPM %s by %s\n", device_name, vendor_name);
242 * send the passed in data to the TPM device.
244 * @data - address of the data to send, byte by byte
245 * @len - length of the data to send
247 * Returns 0 on success, TPM_DRIVER_ERR on error (in case the device does
248 * not accept the entire command).
250 static u32 tis_senddata(const u8 * const data, u32 len)
258 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
259 TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY);
260 if (value == TPM_TIMEOUT_ERR) {
261 printf("%s:%d - failed to get 'command_ready' status\n",
263 return TPM_DRIVER_ERR;
265 burst = burst_count(value);
270 /* Wait till the device is ready to accept more data. */
272 if (max_cycles++ == MAX_DELAY_US) {
273 printf("%s:%d failed to feed %d bytes of %d\n",
274 __FILE__, __LINE__, len - offset, len);
275 return TPM_DRIVER_ERR;
278 burst = burst_count(tpm_read_word(&lpc_tpm_dev
279 [locality].tpm_status));
285 * Calculate number of bytes the TPM is ready to accept in one
288 * We want to send the last byte outside of the loop (hence
289 * the -1 below) to make sure that the 'expected' status bit
290 * changes to zero exactly after the last byte is fed into the
293 count = min(burst, len - offset - 1);
295 tpm_write_byte(data[offset++],
296 &lpc_tpm_dev[locality].data);
298 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
299 TIS_STS_VALID, TIS_STS_VALID);
301 if ((value == TPM_TIMEOUT_ERR) || !(value & TIS_STS_EXPECT)) {
302 printf("%s:%d TPM command feed overflow\n",
304 return TPM_DRIVER_ERR;
307 burst = burst_count(value);
308 if ((offset == (len - 1)) && burst) {
310 * We need to be able to send the last byte to the
311 * device, so burst size must be nonzero before we
318 /* Send the last byte. */
319 tpm_write_byte(data[offset++], &lpc_tpm_dev[locality].data);
321 * Verify that TPM does not expect any more data as part of this
324 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
325 TIS_STS_VALID, TIS_STS_VALID);
326 if ((value == TPM_TIMEOUT_ERR) || (value & TIS_STS_EXPECT)) {
327 printf("%s:%d unexpected TPM status 0x%x\n",
328 __FILE__, __LINE__, value);
329 return TPM_DRIVER_ERR;
332 /* OK, sitting pretty, let's start the command execution. */
333 tpm_write_word(TIS_STS_TPM_GO, &lpc_tpm_dev[locality].tpm_status);
340 * read the TPM device response after a command was issued.
342 * @buffer - address where to read the response, byte by byte.
343 * @len - pointer to the size of buffer
345 * On success stores the number of received bytes to len and returns 0. On
346 * errors (misformatted TPM data or synchronization problems) returns
349 static u32 tis_readresponse(u8 *buffer, u32 *len)
355 const u32 has_data = TIS_STS_DATA_AVAILABLE | TIS_STS_VALID;
356 u32 expected_count = *len;
359 /* Wait for the TPM to process the command. */
360 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
362 if (value == TPM_TIMEOUT_ERR) {
363 printf("%s:%d failed processing command\n",
365 return TPM_DRIVER_ERR;
369 while ((burst = burst_count(value)) == 0) {
370 if (max_cycles++ == MAX_DELAY_US) {
371 printf("%s:%d TPM stuck on read\n",
373 return TPM_DRIVER_ERR;
376 value = tpm_read_word(&lpc_tpm_dev
377 [locality].tpm_status);
382 while (burst-- && (offset < expected_count)) {
383 buffer[offset++] = tpm_read_byte(&lpc_tpm_dev
388 * We got the first six bytes of the reply,
389 * let's figure out how many bytes to expect
390 * total - it is stored as a 4 byte number in
391 * network order, starting with offset 2 into
392 * the body of the reply.
397 sizeof(real_length));
398 expected_count = be32_to_cpu(real_length);
400 if ((expected_count < offset) ||
401 (expected_count > *len)) {
402 printf("%s:%d bad response size %d\n",
405 return TPM_DRIVER_ERR;
410 /* Wait for the next portion. */
411 value = tis_wait_reg(&lpc_tpm_dev[locality].tpm_status,
412 TIS_STS_VALID, TIS_STS_VALID);
413 if (value == TPM_TIMEOUT_ERR) {
414 printf("%s:%d failed to read response\n",
416 return TPM_DRIVER_ERR;
419 if (offset == expected_count)
420 break; /* We got all we needed. */
422 } while ((value & has_data) == has_data);
425 * Make sure we indeed read all there was. The TIS_STS_VALID bit is
428 if (value & TIS_STS_DATA_AVAILABLE) {
429 printf("%s:%d wrong receive status %x\n",
430 __FILE__, __LINE__, value);
431 return TPM_DRIVER_ERR;
434 /* Tell the TPM that we are done. */
435 tpm_write_word(TIS_STS_COMMAND_READY, &lpc_tpm_dev
436 [locality].tpm_status);
443 u8 locality = 0; /* we use locality zero for everything. */
446 return TPM_DRIVER_ERR;
448 /* now request access to locality. */
449 tpm_write_word(TIS_ACCESS_REQUEST_USE, &lpc_tpm_dev[locality].access);
451 /* did we get a lock? */
452 if (tis_wait_reg(&lpc_tpm_dev[locality].access,
453 TIS_ACCESS_ACTIVE_LOCALITY,
454 TIS_ACCESS_ACTIVE_LOCALITY) == TPM_TIMEOUT_ERR) {
455 printf("%s:%d - failed to lock locality %d\n",
456 __FILE__, __LINE__, locality);
457 return TPM_DRIVER_ERR;
460 tpm_write_word(TIS_STS_COMMAND_READY,
461 &lpc_tpm_dev[locality].tpm_status);
469 if (tpm_read_word(&lpc_tpm_dev[locality].access) &
470 TIS_ACCESS_ACTIVE_LOCALITY) {
471 tpm_write_word(TIS_ACCESS_ACTIVE_LOCALITY,
472 &lpc_tpm_dev[locality].access);
474 if (tis_wait_reg(&lpc_tpm_dev[locality].access,
475 TIS_ACCESS_ACTIVE_LOCALITY, 0) ==
477 printf("%s:%d - failed to release locality %d\n",
478 __FILE__, __LINE__, locality);
479 return TPM_DRIVER_ERR;
485 int tis_sendrecv(const u8 *sendbuf, size_t send_size,
486 u8 *recvbuf, size_t *recv_len)
488 if (tis_senddata(sendbuf, send_size)) {
489 printf("%s:%d failed sending data to TPM\n",
491 return TPM_DRIVER_ERR;
494 return tis_readresponse(recvbuf, recv_len);