[J-u-boot.git] / drivers / tpm / tpm_tis_lpc.c

// SPDX-License-Identifier: GPL-2.0+
/*
 * Copyright (c) 2011 The Chromium OS Authors.
 */

/*
 * The code in this file is based on the article "Writing a TPM Device Driver"
 * published on http://ptgmedia.pearsoncmg.com.
 *
 * One principal difference is that in the simplest config the other than 0
 * TPM localities do not get mapped by some devices (for instance, by Infineon
 * slb9635), so this driver provides access to locality 0 only.
 */

#include <common.h>
#include <dm.h>
#include <log.h>
#include <mapmem.h>
#include <tpm-v1.h>
#include <asm/io.h>
#include <linux/delay.h>

#define PREFIX "lpc_tpm: "

enum i2c_chip_type {
	SLB9635,
	AT97SC3204,
};

static const char * const chip_name[] = {
	[SLB9635] = "Infineon SLB9635 TT 1.2",
	[AT97SC3204] = "Atmel AT97SC3204",
};

static const u32 chip_didvid[] = {
	[SLB9635] = 0xb15d1,
	[AT97SC3204] = 0x32041114,
};

struct tpm_locality {
	u32 access;
	u8 padding0[4];
	u32 int_enable;
	u8 vector;
	u8 padding1[3];
	u32 int_status;
	u32 int_capability;
	u32 tpm_status;
	u8 padding2[8];
	u8 data;
	u8 padding3[3803];
	u32 did_vid;
	u8 rid;
	u8 padding4[251];
};

struct tpm_tis_lpc_priv {
	struct tpm_locality *regs;
};

/*
 * This pointer refers to the TPM chip, 5 of its localities are mapped as an
 * array.
 */
#define TPM_TOTAL_LOCALITIES	5

/* Some registers' bit field definitions */
#define TIS_STS_VALID                  (1 << 7) /* 0x80 */
#define TIS_STS_COMMAND_READY          (1 << 6) /* 0x40 */
#define TIS_STS_TPM_GO                 (1 << 5) /* 0x20 */
#define TIS_STS_DATA_AVAILABLE         (1 << 4) /* 0x10 */
#define TIS_STS_EXPECT                 (1 << 3) /* 0x08 */
#define TIS_STS_RESPONSE_RETRY         (1 << 1) /* 0x02 */

#define TIS_ACCESS_TPM_REG_VALID_STS   (1 << 7) /* 0x80 */
#define TIS_ACCESS_ACTIVE_LOCALITY     (1 << 5) /* 0x20 */
#define TIS_ACCESS_BEEN_SEIZED         (1 << 4) /* 0x10 */
#define TIS_ACCESS_SEIZE               (1 << 3) /* 0x08 */
#define TIS_ACCESS_PENDING_REQUEST     (1 << 2) /* 0x04 */
#define TIS_ACCESS_REQUEST_USE         (1 << 1) /* 0x02 */
#define TIS_ACCESS_TPM_ESTABLISHMENT   (1 << 0) /* 0x01 */

#define TIS_STS_BURST_COUNT_MASK       (0xffff)
#define TIS_STS_BURST_COUNT_SHIFT      (8)

 /* 1 second is plenty for anything TPM does. */
#define MAX_DELAY_US	(1000 * 1000)

/* Retrieve burst count value out of the status register contents. */
static u16 burst_count(u32 status)
{
	return (status >> TIS_STS_BURST_COUNT_SHIFT) &
			TIS_STS_BURST_COUNT_MASK;
}

/* TPM access wrappers to support tracing */
static u8 tpm_read_byte(struct tpm_tis_lpc_priv *priv, const u8 *ptr)
{
	u8  ret = readb(ptr);
	debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n",
	      (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
	return ret;
}

static u32 tpm_read_word(struct tpm_tis_lpc_priv *priv, const u32 *ptr)
{
	u32  ret = readl(ptr);
	debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n",
	      (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
	return ret;
}

static void tpm_write_byte(struct tpm_tis_lpc_priv *priv, u8 value, u8 *ptr)
{
	debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n",
	      (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
	writeb(value, ptr);
}

static void tpm_write_word(struct tpm_tis_lpc_priv *priv, u32 value,
			   u32 *ptr)
{
	debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n",
	      (u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
	writel(value, ptr);
}

/*
 * tis_wait_reg()
 *
 * Wait for at least a second for a register to change its state to match the
 * expected state. Normally the transition happens within microseconds.
 *
 * @reg - pointer to the TPM register
 * @mask - bitmask for the bitfield(s) to watch
 * @expected - value the field(s) are supposed to be set to
 *
 * Returns the register contents in case the expected value was found in the
 * appropriate register bits, or -ETIMEDOUT on timeout.
 */
static int tis_wait_reg(struct tpm_tis_lpc_priv *priv, u32 *reg, u8 mask,
			u8 expected)
{
	u32 time_us = MAX_DELAY_US;

	while (time_us > 0) {
		u32 value = tpm_read_word(priv, reg);
		if ((value & mask) == expected)
			return value;
		udelay(1); /* 1 us */
		time_us--;
	}

	return -ETIMEDOUT;
}

/*
 * Probe the TPM device and try determining its manufacturer/device name.
 *
 * Returns 0 on success, -ve on error
 */
static int tpm_tis_lpc_probe(struct udevice *dev)
{
	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
	fdt_addr_t addr;
	u32 didvid;
	ulong chip_type = dev_get_driver_data(dev);

	addr = dev_read_addr(dev);
	if (addr == FDT_ADDR_T_NONE)
		return -EINVAL;
	priv->regs = map_sysmem(addr, 0);
	didvid = tpm_read_word(priv, &priv->regs[0].did_vid);

	if (didvid != chip_didvid[chip_type]) {
		u32 vid, did;
		vid = didvid & 0xffff;
		did = (didvid >> 16) & 0xffff;
		debug("Invalid vendor/device ID %04x/%04x\n", vid, did);
		return -ENODEV;
	}

	debug("Found TPM: %s\n", chip_name[chip_type]);

	return 0;
}

/*
 * tis_senddata()
 *
 * send the passed in data to the TPM device.
 *
 * @data - address of the data to send, byte by byte
 * @len - length of the data to send
 *
 * Returns 0 on success, -ve on error (in case the device does not accept
 * the entire command).
 */
static int tis_senddata(struct udevice *dev, const u8 *data, size_t len)
{
	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
	struct tpm_locality *regs = priv->regs;
	u32 offset = 0;
	u16 burst = 0;
	u32 max_cycles = 0;
	u8 locality = 0;
	u32 value;

	value = tis_wait_reg(priv, &regs[locality].tpm_status,
			     TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY);
	if (value == -ETIMEDOUT) {
		printf("%s:%d - failed to get 'command_ready' status\n",
		       __FILE__, __LINE__);
		return value;
	}
	burst = burst_count(value);

	while (1) {
		unsigned count;

		/* Wait till the device is ready to accept more data. */
		while (!burst) {
			if (max_cycles++ == MAX_DELAY_US) {
				printf("%s:%d failed to feed %zd bytes of %zd\n",
				       __FILE__, __LINE__, len - offset, len);
				return -ETIMEDOUT;
			}
			udelay(1);
			burst = burst_count(tpm_read_word(priv,
					&regs[locality].tpm_status));
		}

		max_cycles = 0;

		/*
		 * Calculate number of bytes the TPM is ready to accept in one
		 * shot.
		 *
		 * We want to send the last byte outside of the loop (hence
		 * the -1 below) to make sure that the 'expected' status bit
		 * changes to zero exactly after the last byte is fed into the
		 * FIFO.
		 */
		count = min((size_t)burst, len - offset - 1);
		while (count--)
			tpm_write_byte(priv, data[offset++],
				       &regs[locality].data);

		value = tis_wait_reg(priv, &regs[locality].tpm_status,
				     TIS_STS_VALID, TIS_STS_VALID);

		if ((value == -ETIMEDOUT) || !(value & TIS_STS_EXPECT)) {
			printf("%s:%d TPM command feed overflow\n",
			       __FILE__, __LINE__);
			return value == -ETIMEDOUT ? value : -EIO;
		}

		burst = burst_count(value);
		if ((offset == (len - 1)) && burst) {
			/*
			 * We need to be able to send the last byte to the
			 * device, so burst size must be nonzero before we
			 * break out.
			 */
			break;
		}
	}

	/* Send the last byte. */
	tpm_write_byte(priv, data[offset++], &regs[locality].data);
	/*
	 * Verify that TPM does not expect any more data as part of this
	 * command.
	 */
	value = tis_wait_reg(priv, &regs[locality].tpm_status,
			     TIS_STS_VALID, TIS_STS_VALID);
	if ((value == -ETIMEDOUT) || (value & TIS_STS_EXPECT)) {
		printf("%s:%d unexpected TPM status 0x%x\n",
		       __FILE__, __LINE__, value);
		return value == -ETIMEDOUT ? value : -EIO;
	}

	/* OK, sitting pretty, let's start the command execution. */
	tpm_write_word(priv, TIS_STS_TPM_GO, &regs[locality].tpm_status);
	return 0;
}

/*
 * tis_readresponse()
 *
 * read the TPM device response after a command was issued.
 *
 * @buffer - address where to read the response, byte by byte.
 * @len - pointer to the size of buffer
 *
 * On success stores the number of received bytes to len and returns 0. On
 * errors (misformatted TPM data or synchronization problems) returns
 * -ve value.
 */
static int tis_readresponse(struct udevice *dev, u8 *buffer, size_t len)
{
	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
	struct tpm_locality *regs = priv->regs;
	u16 burst;
	u32 value;
	u32 offset = 0;
	u8 locality = 0;
	const u32 has_data = TIS_STS_DATA_AVAILABLE | TIS_STS_VALID;
	u32 expected_count = len;
	int max_cycles = 0;

	/* Wait for the TPM to process the command. */
	value = tis_wait_reg(priv, &regs[locality].tpm_status,
			      has_data, has_data);
	if (value == -ETIMEDOUT) {
		printf("%s:%d failed processing command\n",
		       __FILE__, __LINE__);
		return value;
	}

	do {
		while ((burst = burst_count(value)) == 0) {
			if (max_cycles++ == MAX_DELAY_US) {
				printf("%s:%d TPM stuck on read\n",
				       __FILE__, __LINE__);
				return -EIO;
			}
			udelay(1);
			value = tpm_read_word(priv, &regs[locality].tpm_status);
		}

		max_cycles = 0;

		while (burst-- && (offset < expected_count)) {
			buffer[offset++] = tpm_read_byte(priv,
						&regs[locality].data);

			if (offset == 6) {
				/*
				 * We got the first six bytes of the reply,
				 * let's figure out how many bytes to expect
				 * total - it is stored as a 4 byte number in
				 * network order, starting with offset 2 into
				 * the body of the reply.
				 */
				u32 real_length;
				memcpy(&real_length,
				       buffer + 2,
				       sizeof(real_length));
				expected_count = be32_to_cpu(real_length);

				if ((expected_count < offset) ||
				    (expected_count > len)) {
					printf("%s:%d bad response size %d\n",
					       __FILE__, __LINE__,
					       expected_count);
					return -ENOSPC;
				}
			}
		}

		/* Wait for the next portion. */
		value = tis_wait_reg(priv, &regs[locality].tpm_status,
				     TIS_STS_VALID, TIS_STS_VALID);
		if (value == -ETIMEDOUT) {
			printf("%s:%d failed to read response\n",
			       __FILE__, __LINE__);
			return value;
		}

		if (offset == expected_count)
			break;	/* We got all we needed. */

	} while ((value & has_data) == has_data);

	/*
	 * Make sure we indeed read all there was. The TIS_STS_VALID bit is
	 * known to be set.
	 */
	if (value & TIS_STS_DATA_AVAILABLE) {
		printf("%s:%d wrong receive status %x\n",
		       __FILE__, __LINE__, value);
		return -EBADMSG;
	}

	/* Tell the TPM that we are done. */
	tpm_write_word(priv, TIS_STS_COMMAND_READY,
		       &regs[locality].tpm_status);

	return offset;
}

static int tpm_tis_lpc_close(struct udevice *dev)
{
	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
	struct tpm_locality *regs = priv->regs;
	u8 locality = 0;

	if (tpm_read_word(priv, &regs[locality].access) &
	    TIS_ACCESS_ACTIVE_LOCALITY) {
		tpm_write_word(priv, TIS_ACCESS_ACTIVE_LOCALITY,
			       &regs[locality].access);

		if (tis_wait_reg(priv, &regs[locality].access,
				 TIS_ACCESS_ACTIVE_LOCALITY, 0) == -ETIMEDOUT) {
			printf("%s:%d - failed to release locality %d\n",
			       __FILE__, __LINE__, locality);
			return -ETIMEDOUT;
		}
	}
	return 0;
}

static int tpm_tis_lpc_open(struct udevice *dev)
{
	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
	struct tpm_locality *regs = priv->regs;
	u8 locality = 0; /* we use locality zero for everything. */
	int ret;

	ret = tpm_tis_lpc_close(dev);
	if (ret) {
		printf("%s: Failed to close TPM\n", __func__);
		return ret;
	}

	/* now request access to locality. */
	tpm_write_word(priv, TIS_ACCESS_REQUEST_USE, &regs[locality].access);

	/* did we get a lock? */
	ret = tis_wait_reg(priv, &regs[locality].access,
			 TIS_ACCESS_ACTIVE_LOCALITY,
			 TIS_ACCESS_ACTIVE_LOCALITY);
	if (ret == -ETIMEDOUT) {
		printf("%s:%d - failed to lock locality %d\n",
		       __FILE__, __LINE__, locality);
		return ret;
	}

	tpm_write_word(priv, TIS_STS_COMMAND_READY,
		       &regs[locality].tpm_status);

	return 0;
}

static int tpm_tis_lpc_get_desc(struct udevice *dev, char *buf, int size)
{
	ulong chip_type = dev_get_driver_data(dev);

	if (size < 50)
		return -ENOSPC;

	return snprintf(buf, size, "1.2 TPM (%s)",
			chip_name[chip_type]);
}


static const struct tpm_ops tpm_tis_lpc_ops = {
	.open		= tpm_tis_lpc_open,
	.close		= tpm_tis_lpc_close,
	.get_desc	= tpm_tis_lpc_get_desc,
	.send		= tis_senddata,
	.recv		= tis_readresponse,
};

static const struct udevice_id tpm_tis_lpc_ids[] = {
	{ .compatible = "infineon,slb9635lpc", .data = SLB9635 },
	{ .compatible = "atmel,at97sc3204", .data = AT97SC3204 },
	{ }
};

U_BOOT_DRIVER(tpm_tis_lpc) = {
	.name   = "tpm_tis_lpc",
	.id     = UCLASS_TPM,
	.of_match = tpm_tis_lpc_ids,
	.ops    = &tpm_tis_lpc_ops,
	.probe	= tpm_tis_lpc_probe,
	.priv_auto	= sizeof(struct tpm_tis_lpc_priv),
};
Commit	Line	Data
83d290c5	1	// SPDX-License-Identifier: GPL-2.0+
5e124724 VB	2	/*
5e124724 VB	3	* Copyright (c) 2011 The Chromium OS Authors.
5e124724 VB	4	*/
	5
	6	/*
	7	* The code in this file is based on the article "Writing a TPM Device Driver"
	8	* published on http://ptgmedia.pearsoncmg.com.
	9	*
	10	* One principal difference is that in the simplest config the other than 0
	11	* TPM localities do not get mapped by some devices (for instance, by Infineon
	12	* slb9635), so this driver provides access to locality 0 only.
	13	*/
	14
	15	#include <common.h>
d616ba5f	16	#include <dm.h>
f7ae49fc	17	#include <log.h>
d616ba5f	18	#include <mapmem.h>
d677bfe2	19	#include <tpm-v1.h>
d616ba5f	20	#include <asm/io.h>
c05ed00a	21	#include <linux/delay.h>
5e124724 VB	22
	23	#define PREFIX "lpc_tpm: "
	24
a982b6f5 GM	25	enum i2c_chip_type {
	26	SLB9635,
	27	AT97SC3204,
	28	};
	29
	30	static const char * const chip_name[] = {
	31	[SLB9635] = "Infineon SLB9635 TT 1.2",
	32	[AT97SC3204] = "Atmel AT97SC3204",
	33	};
	34
	35	static const u32 chip_didvid[] = {
	36	[SLB9635] = 0xb15d1,
	37	[AT97SC3204] = 0x32041114,
	38	};
	39
5e124724 VB	40	struct tpm_locality {
	41	u32 access;
	42	u8 padding0[4];
	43	u32 int_enable;
	44	u8 vector;
	45	u8 padding1[3];
	46	u32 int_status;
	47	u32 int_capability;
	48	u32 tpm_status;
	49	u8 padding2[8];
	50	u8 data;
	51	u8 padding3[3803];
	52	u32 did_vid;
	53	u8 rid;
	54	u8 padding4[251];
	55	};
	56
d616ba5f SG	57	struct tpm_tis_lpc_priv {
	58	struct tpm_locality *regs;
	59	};
	60
5e124724 VB	61	/*
	62	* This pointer refers to the TPM chip, 5 of its localities are mapped as an
	63	* array.
	64	*/
	65	#define TPM_TOTAL_LOCALITIES 5
5e124724 VB	66
	67	/* Some registers' bit field definitions */
	68	#define TIS_STS_VALID (1 << 7) /* 0x80 */
	69	#define TIS_STS_COMMAND_READY (1 << 6) /* 0x40 */
	70	#define TIS_STS_TPM_GO (1 << 5) /* 0x20 */
	71	#define TIS_STS_DATA_AVAILABLE (1 << 4) /* 0x10 */
	72	#define TIS_STS_EXPECT (1 << 3) /* 0x08 */
	73	#define TIS_STS_RESPONSE_RETRY (1 << 1) /* 0x02 */
	74
	75	#define TIS_ACCESS_TPM_REG_VALID_STS (1 << 7) /* 0x80 */
	76	#define TIS_ACCESS_ACTIVE_LOCALITY (1 << 5) /* 0x20 */
	77	#define TIS_ACCESS_BEEN_SEIZED (1 << 4) /* 0x10 */
	78	#define TIS_ACCESS_SEIZE (1 << 3) /* 0x08 */
	79	#define TIS_ACCESS_PENDING_REQUEST (1 << 2) /* 0x04 */
	80	#define TIS_ACCESS_REQUEST_USE (1 << 1) /* 0x02 */
	81	#define TIS_ACCESS_TPM_ESTABLISHMENT (1 << 0) /* 0x01 */
	82
	83	#define TIS_STS_BURST_COUNT_MASK (0xffff)
	84	#define TIS_STS_BURST_COUNT_SHIFT (8)
	85
5e124724 VB	86	/* 1 second is plenty for anything TPM does. */
	87	#define MAX_DELAY_US (1000 * 1000)
	88
	89	/* Retrieve burst count value out of the status register contents. */
	90	static u16 burst_count(u32 status)
	91	{
d616ba5f SG	92	return (status >> TIS_STS_BURST_COUNT_SHIFT) &
d616ba5f SG	93	TIS_STS_BURST_COUNT_MASK;
5e124724 VB	94	}
5e124724 VB	95
5e124724	96	/* TPM access wrappers to support tracing */
d616ba5f	97	static u8 tpm_read_byte(struct tpm_tis_lpc_priv priv, const u8 ptr)
5e124724 VB	98	{
	99	u8 ret = readb(ptr);
	100	debug(PREFIX "Read reg 0x%4.4x returns 0x%2.2x\n",
d616ba5f	101	(u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
5e124724 VB	102	return ret;
	103	}
	104
d616ba5f	105	static u32 tpm_read_word(struct tpm_tis_lpc_priv priv, const u32 ptr)
5e124724 VB	106	{
	107	u32 ret = readl(ptr);
	108	debug(PREFIX "Read reg 0x%4.4x returns 0x%8.8x\n",
d616ba5f	109	(u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, ret);
5e124724 VB	110	return ret;
	111	}
	112
d616ba5f	113	static void tpm_write_byte(struct tpm_tis_lpc_priv priv, u8 value, u8 ptr)
5e124724 VB	114	{
5e124724 VB	115	debug(PREFIX "Write reg 0x%4.4x with 0x%2.2x\n",
d616ba5f	116	(u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
5e124724 VB	117	writeb(value, ptr);
	118	}
	119
d616ba5f SG	120	static void tpm_write_word(struct tpm_tis_lpc_priv *priv, u32 value,
d616ba5f SG	121	u32 *ptr)
5e124724 VB	122	{
5e124724 VB	123	debug(PREFIX "Write reg 0x%4.4x with 0x%8.8x\n",
d616ba5f	124	(u32)(uintptr_t)ptr - (u32)(uintptr_t)priv->regs, value);
5e124724 VB	125	writel(value, ptr);
	126	}
	127
	128	/*
	129	* tis_wait_reg()
	130	*
	131	* Wait for at least a second for a register to change its state to match the
	132	* expected state. Normally the transition happens within microseconds.
	133	*
	134	* @reg - pointer to the TPM register
	135	* @mask - bitmask for the bitfield(s) to watch
	136	* @expected - value the field(s) are supposed to be set to
	137	*
	138	* Returns the register contents in case the expected value was found in the
d616ba5f	139	* appropriate register bits, or -ETIMEDOUT on timeout.
5e124724	140	*/
d616ba5f SG	141	static int tis_wait_reg(struct tpm_tis_lpc_priv priv, u32 reg, u8 mask,
d616ba5f SG	142	u8 expected)
5e124724 VB	143	{
	144	u32 time_us = MAX_DELAY_US;
	145
	146	while (time_us > 0) {
d616ba5f	147	u32 value = tpm_read_word(priv, reg);
5e124724 VB	148	if ((value & mask) == expected)
	149	return value;
	150	udelay(1); /* 1 us */
	151	time_us--;
	152	}
d616ba5f SG	153
d616ba5f SG	154	return -ETIMEDOUT;
5e124724 VB	155	}
	156
	157	/*
	158	* Probe the TPM device and try determining its manufacturer/device name.
	159	*
d616ba5f	160	* Returns 0 on success, -ve on error
5e124724	161	*/
d616ba5f	162	static int tpm_tis_lpc_probe(struct udevice *dev)
5e124724	163	{
d616ba5f	164	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
d616ba5f SG	165	fdt_addr_t addr;
d616ba5f SG	166	u32 didvid;
a982b6f5	167	ulong chip_type = dev_get_driver_data(dev);
5e124724	168
c89d32a7	169	addr = dev_read_addr(dev);
d616ba5f SG	170	if (addr == FDT_ADDR_T_NONE)
	171	return -EINVAL;
	172	priv->regs = map_sysmem(addr, 0);
	173	didvid = tpm_read_word(priv, &priv->regs[0].did_vid);
5e124724	174
a982b6f5 GM	175	if (didvid != chip_didvid[chip_type]) {
	176	u32 vid, did;
	177	vid = didvid & 0xffff;
	178	did = (didvid >> 16) & 0xffff;
d616ba5f	179	debug("Invalid vendor/device ID %04x/%04x\n", vid, did);
a982b6f5	180	return -ENODEV;
5e124724 VB	181	}
5e124724 VB	182
a982b6f5	183	debug("Found TPM: %s\n", chip_name[chip_type]);
d616ba5f	184
5e124724 VB	185	return 0;
	186	}
	187
	188	/*
	189	* tis_senddata()
	190	*
	191	* send the passed in data to the TPM device.
	192	*
	193	* @data - address of the data to send, byte by byte
	194	* @len - length of the data to send
	195	*
d616ba5f SG	196	* Returns 0 on success, -ve on error (in case the device does not accept
d616ba5f SG	197	* the entire command).
5e124724	198	*/
d616ba5f	199	static int tis_senddata(struct udevice dev, const u8 data, size_t len)
5e124724	200	{
d616ba5f SG	201	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
d616ba5f SG	202	struct tpm_locality *regs = priv->regs;
5e124724 VB	203	u32 offset = 0;
	204	u16 burst = 0;
	205	u32 max_cycles = 0;
	206	u8 locality = 0;
	207	u32 value;
	208
d616ba5f	209	value = tis_wait_reg(priv, &regs[locality].tpm_status,
5e124724	210	TIS_STS_COMMAND_READY, TIS_STS_COMMAND_READY);
d616ba5f	211	if (value == -ETIMEDOUT) {
5e124724 VB	212	printf("%s:%d - failed to get 'command_ready' status\n",
5e124724 VB	213	__FILE__, __LINE__);
d616ba5f	214	return value;
5e124724 VB	215	}
	216	burst = burst_count(value);
	217
	218	while (1) {
	219	unsigned count;
	220
	221	/* Wait till the device is ready to accept more data. */
	222	while (!burst) {
	223	if (max_cycles++ == MAX_DELAY_US) {
22230e91	224	printf("%s:%d failed to feed %zd bytes of %zd\n",
5e124724	225	__FILE__, __LINE__, len - offset, len);
d616ba5f	226	return -ETIMEDOUT;
5e124724 VB	227	}
5e124724 VB	228	udelay(1);
d616ba5f SG	229	burst = burst_count(tpm_read_word(priv,
d616ba5f SG	230	&regs[locality].tpm_status));
5e124724 VB	231	}
	232
	233	max_cycles = 0;
	234
	235	/*
	236	* Calculate number of bytes the TPM is ready to accept in one
	237	* shot.
	238	*
	239	* We want to send the last byte outside of the loop (hence
	240	* the -1 below) to make sure that the 'expected' status bit
	241	* changes to zero exactly after the last byte is fed into the
	242	* FIFO.
	243	*/
22230e91	244	count = min((size_t)burst, len - offset - 1);
5e124724	245	while (count--)
d616ba5f SG	246	tpm_write_byte(priv, data[offset++],
d616ba5f SG	247	&regs[locality].data);
5e124724	248
d616ba5f	249	value = tis_wait_reg(priv, &regs[locality].tpm_status,
5e124724 VB	250	TIS_STS_VALID, TIS_STS_VALID);
5e124724 VB	251
d616ba5f	252	if ((value == -ETIMEDOUT) \|\| !(value & TIS_STS_EXPECT)) {
5e124724 VB	253	printf("%s:%d TPM command feed overflow\n",
5e124724 VB	254	__FILE__, __LINE__);
d616ba5f	255	return value == -ETIMEDOUT ? value : -EIO;
5e124724 VB	256	}
	257
	258	burst = burst_count(value);
	259	if ((offset == (len - 1)) && burst) {
	260	/*
	261	* We need to be able to send the last byte to the
	262	* device, so burst size must be nonzero before we
	263	* break out.
	264	*/
	265	break;
	266	}
	267	}
	268
	269	/* Send the last byte. */
d616ba5f	270	tpm_write_byte(priv, data[offset++], &regs[locality].data);
5e124724 VB	271	/*
	272	* Verify that TPM does not expect any more data as part of this
	273	* command.
	274	*/
d616ba5f	275	value = tis_wait_reg(priv, &regs[locality].tpm_status,
5e124724	276	TIS_STS_VALID, TIS_STS_VALID);
d616ba5f	277	if ((value == -ETIMEDOUT) \|\| (value & TIS_STS_EXPECT)) {
5e124724 VB	278	printf("%s:%d unexpected TPM status 0x%x\n",
5e124724 VB	279	__FILE__, __LINE__, value);
d616ba5f	280	return value == -ETIMEDOUT ? value : -EIO;
5e124724 VB	281	}
	282
	283	/* OK, sitting pretty, let's start the command execution. */
d616ba5f	284	tpm_write_word(priv, TIS_STS_TPM_GO, &regs[locality].tpm_status);
5e124724 VB	285	return 0;
	286	}
	287
	288	/*
	289	* tis_readresponse()
	290	*
	291	* read the TPM device response after a command was issued.
	292	*
	293	* @buffer - address where to read the response, byte by byte.
	294	* @len - pointer to the size of buffer
	295	*
	296	* On success stores the number of received bytes to len and returns 0. On
	297	* errors (misformatted TPM data or synchronization problems) returns
d616ba5f	298	* -ve value.
5e124724	299	*/
d616ba5f	300	static int tis_readresponse(struct udevice dev, u8 buffer, size_t len)
5e124724	301	{
d616ba5f SG	302	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
d616ba5f SG	303	struct tpm_locality *regs = priv->regs;
5e124724 VB	304	u16 burst;
	305	u32 value;
	306	u32 offset = 0;
	307	u8 locality = 0;
	308	const u32 has_data = TIS_STS_DATA_AVAILABLE \| TIS_STS_VALID;
d616ba5f	309	u32 expected_count = len;
5e124724 VB	310	int max_cycles = 0;
	311
	312	/* Wait for the TPM to process the command. */
d616ba5f	313	value = tis_wait_reg(priv, &regs[locality].tpm_status,
5e124724	314	has_data, has_data);
d616ba5f	315	if (value == -ETIMEDOUT) {
5e124724 VB	316	printf("%s:%d failed processing command\n",
5e124724 VB	317	__FILE__, __LINE__);
d616ba5f	318	return value;
5e124724 VB	319	}
	320
	321	do {
	322	while ((burst = burst_count(value)) == 0) {
	323	if (max_cycles++ == MAX_DELAY_US) {
	324	printf("%s:%d TPM stuck on read\n",
	325	__FILE__, __LINE__);
d616ba5f	326	return -EIO;
5e124724 VB	327	}
5e124724 VB	328	udelay(1);
d616ba5f	329	value = tpm_read_word(priv, &regs[locality].tpm_status);
5e124724 VB	330	}
	331
	332	max_cycles = 0;
	333
	334	while (burst-- && (offset < expected_count)) {
d616ba5f SG	335	buffer[offset++] = tpm_read_byte(priv,
d616ba5f SG	336	&regs[locality].data);
5e124724 VB	337
	338	if (offset == 6) {
	339	/*
	340	* We got the first six bytes of the reply,
	341	* let's figure out how many bytes to expect
	342	* total - it is stored as a 4 byte number in
	343	* network order, starting with offset 2 into
	344	* the body of the reply.
	345	*/
	346	u32 real_length;
	347	memcpy(&real_length,
	348	buffer + 2,
	349	sizeof(real_length));
	350	expected_count = be32_to_cpu(real_length);
	351
	352	if ((expected_count < offset) \|\|
d616ba5f	353	(expected_count > len)) {
5e124724 VB	354	printf("%s:%d bad response size %d\n",
	355	__FILE__, __LINE__,
	356	expected_count);
d616ba5f	357	return -ENOSPC;
5e124724 VB	358	}
	359	}
	360	}
	361
	362	/* Wait for the next portion. */
d616ba5f	363	value = tis_wait_reg(priv, &regs[locality].tpm_status,
5e124724	364	TIS_STS_VALID, TIS_STS_VALID);
d616ba5f	365	if (value == -ETIMEDOUT) {
5e124724 VB	366	printf("%s:%d failed to read response\n",
5e124724 VB	367	__FILE__, __LINE__);
d616ba5f	368	return value;
5e124724 VB	369	}
	370
	371	if (offset == expected_count)
	372	break; /* We got all we needed. */
	373
	374	} while ((value & has_data) == has_data);
	375
	376	/*
	377	* Make sure we indeed read all there was. The TIS_STS_VALID bit is
	378	* known to be set.
	379	*/
	380	if (value & TIS_STS_DATA_AVAILABLE) {
	381	printf("%s:%d wrong receive status %x\n",
	382	__FILE__, __LINE__, value);
d616ba5f	383	return -EBADMSG;
5e124724 VB	384	}
	385
	386	/* Tell the TPM that we are done. */
d616ba5f SG	387	tpm_write_word(priv, TIS_STS_COMMAND_READY,
	388	&regs[locality].tpm_status);
	389
	390	return offset;
5e124724 VB	391	}
5e124724 VB	392
51f00c17 SG	393	static int tpm_tis_lpc_close(struct udevice *dev)
	394	{
	395	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
	396	struct tpm_locality *regs = priv->regs;
	397	u8 locality = 0;
	398
	399	if (tpm_read_word(priv, &regs[locality].access) &
	400	TIS_ACCESS_ACTIVE_LOCALITY) {
	401	tpm_write_word(priv, TIS_ACCESS_ACTIVE_LOCALITY,
	402	&regs[locality].access);
	403
	404	if (tis_wait_reg(priv, &regs[locality].access,
	405	TIS_ACCESS_ACTIVE_LOCALITY, 0) == -ETIMEDOUT) {
	406	printf("%s:%d - failed to release locality %d\n",
	407	__FILE__, __LINE__, locality);
	408	return -ETIMEDOUT;
	409	}
	410	}
	411	return 0;
	412	}
	413
d616ba5f	414	static int tpm_tis_lpc_open(struct udevice *dev)
5e124724	415	{
d616ba5f SG	416	struct tpm_tis_lpc_priv *priv = dev_get_priv(dev);
d616ba5f SG	417	struct tpm_locality *regs = priv->regs;
5e124724	418	u8 locality = 0; /* we use locality zero for everything. */
d616ba5f	419	int ret;
5e124724	420
51f00c17 SG	421	ret = tpm_tis_lpc_close(dev);
	422	if (ret) {
	423	printf("%s: Failed to close TPM\n", __func__);
	424	return ret;
	425	}
	426
5e124724	427	/* now request access to locality. */
d616ba5f	428	tpm_write_word(priv, TIS_ACCESS_REQUEST_USE, &regs[locality].access);
5e124724 VB	429
5e124724 VB	430	/* did we get a lock? */
d616ba5f	431	ret = tis_wait_reg(priv, &regs[locality].access,
5e124724	432	TIS_ACCESS_ACTIVE_LOCALITY,
d616ba5f SG	433	TIS_ACCESS_ACTIVE_LOCALITY);
d616ba5f SG	434	if (ret == -ETIMEDOUT) {
5e124724 VB	435	printf("%s:%d - failed to lock locality %d\n",
5e124724 VB	436	__FILE__, __LINE__, locality);
d616ba5f	437	return ret;
5e124724 VB	438	}
5e124724 VB	439
d616ba5f SG	440	tpm_write_word(priv, TIS_STS_COMMAND_READY,
d616ba5f SG	441	&regs[locality].tpm_status);
5e124724	442
5e124724 VB	443	return 0;
	444	}
	445
c9e6d9c8	446	static int tpm_tis_lpc_get_desc(struct udevice dev, char buf, int size)
5e124724	447	{
a982b6f5 GM	448	ulong chip_type = dev_get_driver_data(dev);
a982b6f5 GM	449
d616ba5f SG	450	if (size < 50)
d616ba5f SG	451	return -ENOSPC;
5e124724	452
a982b6f5 GM	453	return snprintf(buf, size, "1.2 TPM (%s)",
a982b6f5 GM	454	chip_name[chip_type]);
5e124724	455	}
d616ba5f SG	456
	457
	458	static const struct tpm_ops tpm_tis_lpc_ops = {
	459	.open = tpm_tis_lpc_open,
	460	.close = tpm_tis_lpc_close,
c9e6d9c8	461	.get_desc = tpm_tis_lpc_get_desc,
d616ba5f SG	462	.send = tis_senddata,
	463	.recv = tis_readresponse,
	464	};
	465
	466	static const struct udevice_id tpm_tis_lpc_ids[] = {
a982b6f5 GM	467	{ .compatible = "infineon,slb9635lpc", .data = SLB9635 },
a982b6f5 GM	468	{ .compatible = "atmel,at97sc3204", .data = AT97SC3204 },
d616ba5f SG	469	{ }
	470	};
	471
	472	U_BOOT_DRIVER(tpm_tis_lpc) = {
	473	.name = "tpm_tis_lpc",
	474	.id = UCLASS_TPM,
	475	.of_match = tpm_tis_lpc_ids,
	476	.ops = &tpm_tis_lpc_ops,
	477	.probe = tpm_tis_lpc_probe,
41575d8e	478	.priv_auto = sizeof(struct tpm_tis_lpc_priv),
d616ba5f	479	};