aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char/tpm/tpm_crb.c
Commit message (Collapse)AuthorAge
* tpm_crb: check for bad response sizeJerry Snitselaar2017-05-25
| | | | | | | | | | | | | | | | commit 8569defde8057258835c51ce01a33de82e14b148 upstream. Make sure size of response buffer is at least 6 bytes, or we will underflow and pass large size_t to memcpy_fromio(). This was encountered while testing earlier version of locality patchset. Fixes: 30fc8d138e912 ("tpm: TPM 2.0 CRB Interface") Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Revert "tpm/tpm_crb: implement tpm crb idle state"Jarkko Sakkinen2016-09-27
| | | | | | This reverts commit e17acbbb69d30836a8c12e2c09bbefab8656693e. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* Revert "tmp/tpm_crb: fix Intel PTT hw bug during idle state"Jarkko Sakkinen2016-09-27
| | | | | | This reverts commit 9514ff1961c6f0f5983ba72d94f384bc13e0d4a1. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* Revert "tpm/tpm_crb: open code the crb_init into acpi_add"Jarkko Sakkinen2016-09-27
| | | | | | This reverts commit 0c22db435bf79d3cf3089df7ff198d4867df3c27. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* Revert "tmp/tpm_crb: implement runtime pm for tpm_crb"Jarkko Sakkinen2016-09-27
| | | | | | This reverts commit e350e24694e447e6ab7312fffae5ca31a0bb5165. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tmp/tpm_crb: implement runtime pm for tpm_crbWinkler, Tomas2016-09-16
| | | | | | | | | | | | | | | | Utilize runtime_pm for driving tpm crb idle states. The framework calls cmd_ready from the pm_runtime_resume handler and go idle from the pm_runtime_suspend handler. The TPM framework should wake the device before transmit and receive. In case the runtime_pm framework is not enabled, the device will be in ready state. [jarkko.sakkinen@linux.intel.com: changed pm_runtime_put_sync() to pm_runtime_put()] Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm/tpm_crb: open code the crb_init into acpi_addWinkler, Tomas2016-09-16
| | | | | | | | | This is preparation step for implementing tpm crb runtime pm. We need to have tpm chip allocated and populated before we access the runtime handlers. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinn@linux.intel.com>
* tmp/tpm_crb: fix Intel PTT hw bug during idle stateWinkler, Tomas2016-09-16
| | | | | | | | | | | | | There is a HW bug in Skylake, and Broxton PCH Intel PTT device, where most of the registers in the control area except START, REQUEST, CANCEL, and LOC_CTRL lost retention when the device is in the idle state. Hence we need to bring the device to ready state before accessing the other registers. The fix brings device to ready state before trying to read command and response buffer addresses in order to remap the for access. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinn@linux.intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinn@linux.intel.com>
* tpm/tpm_crb: implement tpm crb idle stateWinkler, Tomas2016-09-16
| | | | | | | | | | | | | | | | | | | | | The register TPM_CRB_CTRL_REQ_x contains bits goIdle and cmdReady for SW to indicate that the device can enter or should exit the idle state. The legacy ACPI-start (SMI + DMA) based devices do not support these bits and the idle state management is not exposed to the host SW. Thus, this functionality only is enabled only for a CRB start (MMIO) based devices. Based on Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> original patch: 'tpm_crb: implement power tpm crb power management' To keep the implementation local to the hw we don't use wait_for_tpm_stat for polling the TPM_CRB_CTRL_REQ. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm/tpm_crb: fix the over 80 characters checkpatch warringTomas Winkler2016-09-15
| | | | | | | | | | | | | | | Because of the line break in the debug print the chackpatch is not silent on 80 characters limitation. The easiest fix is to straighten the lines, it's also more readable. WARNING: line over 80 characters + FW_BUG "TPM2 ACPI table does not define a memory resource\n"); Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm/tpm_crb: drop useless cpu_to_le32 when writing to registersTomas Winkler2016-09-15
| | | | | | | | | Don't apply endianity conversion when writing to the registers this is already handled by the system. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm/tpm_crb: cache cmd_size register value.Tomas Winkler2016-09-15
| | | | | | | | | | | Instead of expensive register access on retrieving cmd_size on each send, save the value during initialization in the private context. The value doesn't change. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tmp/tpm_crb: drop include to platform_deviceTomas Winkler2016-09-15
| | | | | | | | | The platform device is not used in this driver, drop the include to linux/platform_device.h Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm_crb: fix incorrect values of cmdReady and goIdle bitsJarkko Sakkinen2016-09-15
| | | | | | CRB_CTRL_CMD_READY and CRB_CTRL_GO_IDLE have incorrect values. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm_crb: refine the naming of constantsJarkko Sakkinen2016-09-15
| | | | | | | | Renamed CRB protocol specific constants to match the TCG PC Client Platform TPM Profile (PTP) Specification and driver status constants to be explicit that they are driver specific. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm_crb: remove wmb()'sJarkko Sakkinen2016-09-15
| | | | | | wmb()'s are not needed as iowrite32() is used. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm_crb: fix crb_req_canceled behaviorJarkko Sakkinen2016-09-15
| | | | | | | | | | | | | | | | | | | | The req_canceled() callback is used by tpm_transmit() periodically to check whether the request has been canceled while it is receiving a response from the TPM. The TPM_CRB_CTRL_CANCEL register was cleared already in the crb_cancel callback, which has two consequences: * Cancel might not happen. * req_canceled() always returns zero. A better place to clear the register is when starting to send a new command. The behavior of TPM_CRB_CTRL_CANCEL is described in the section 5.5.3.6 of the PTP specification. CC: stable@vger.kernel.org Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm: Factor out common startup codeJason Gunthorpe2016-07-19
| | | | | | | | | | | | | | | | | | | | | The TCG standard startup sequence (get timeouts, tpm startup, etc) for TPM and TPM2 chips is being open coded in many drivers, move it into the core code. tpm_tis and tpm_crb are used as the basis for the core code implementation and the easy drivers are converted. In the process several small drivers bugs relating to error handling this flow are fixed. For now the flag TPM_OPS_AUTO_STARTUP is optional to allow a staged driver roll out, but ultimately all drivers should use this flow and the flag removed. Some drivers still do not implement the startup sequence at all and will need to be tested with it enabled. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Tested-by: Andrew Zamansky <andrew.zamansky@nuvoton.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm_crb: fix address space of the return pointer in crb_map_res()Jarkko Sakkinen2016-06-25
| | | | | | | | | | | | | | When running make C=2 M=drivers/char/tpm/ CHECK drivers/char/tpm//tpm_crb.c drivers/char/tpm//tpm_crb.c:248:31: warning: incorrect type in return expression (different address spaces) drivers/char/tpm//tpm_crb.c:248:31: expected void [noderef] <asn:2>* drivers/char/tpm//tpm_crb.c:248:31: got void * CC: stable@vger.kernel.org Fixes: 1bd047be37d9 ("tpm_crb: Use devm_ioremap_resource") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
* tpm: Remove useless priv field in struct tpm_vendor_specificChristophe Ricard2016-06-25
| | | | | | | | | | Remove useless priv field in struct tpm_vendor_specific and take benefit of chip->dev.driver_data. As priv is the latest field available in struct tpm_vendor_specific, remove any reference to that structure. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm_crb: fix mapping of the buffersJarkko Sakkinen2016-06-25
| | | | | | | | | | | | | | | | | | | | | | | | | On my Lenovo x250 the following situation occurs: [18697.813871] tpm_crb MSFT0101:00: can't request region for resource [mem 0xacdff080-0xacdfffff] The mapping of the control area overlaps the mapping of the command buffer. The control area is mapped over page, which is not right. It should mapped over sizeof(struct crb_control_area). Fixing this issue unmasks another issue. Command and response buffers can overlap and they do interleave on this machine. According to the PTP specification the overlapping means that they are mapped to the same buffer. The commit has been also on a Haswell NUC where things worked before applying this fix so that the both code paths for response buffer initialization are tested. Cc: stable@vger.kernel.org Fixes: 1bd047be37d9 ("tpm_crb: Use devm_ioremap_resource") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
* tpm_crb: drop struct resource res from struct crb_privJarkko Sakkinen2016-06-25
| | | | | | | | | The iomem resource is needed only temporarily so it is better to pass it on instead of storing it permanently. Named the variable as io_res so that the code better documents itself. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
* tpm: fix crash in tpm_tis deinitializationJarkko Sakkinen2016-06-25
| | | | | | | | | | | rmmod crashes the driver because tpm_chip_unregister() already sets ops to NULL. This commit fixes the issue by moving tpm2_shutdown() to tpm_chip_unregister(). This commit is also cleanup because it removes duplicate code from tpm_crb and tpm_tis to the core. Fixes: 4d3eac5e156a ("tpm: Provide strong locking for device removal") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
* tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister()Jarkko Sakkinen2016-02-20
| | | | | | | | | Wrong call order. Reported-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Fixes: 74d6b3ceaa17 Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> cc: stable@vger.kernel.org
* tpm_crb/tis: fix: use dev_name() for /proc/iomemJarkko Sakkinen2016-02-20
| | | | | | | | | In all cases use dev_name() for the mapped resources. This is both for sake of consistency and also with some platforms resource name given by ACPI object seems to return garbage. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Fixes: 1bd047be37d9 ("tpm_crb: Use devm_ioremap_resource")
* tpm_crb: Use devm_ioremap_resourceJason Gunthorpe2016-02-09
| | | | | | | | | | | | | | | | | | | | | To support the force mode in tpm_tis we need to use resource locking in tpm_crb as well, via devm_ioremap_resource. The light restructuring better aligns crb and tis and makes it easier to see the that new changes make sense. The control area and its associated buffers do not always fall in the range of the iomem resource given by the ACPI object. This patch fixes the issue by mapping the buffers if this is the case. [jarkko.sakkinen@linux.intel.com: squashed update described in the last paragraph.] Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Acked-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
* tpm_crb: Drop le32_to_cpu(ioread32(..))Jason Gunthorpe2016-02-09
| | | | | | | | | | | ioread32 and readl are defined to read from PCI style memory, ie little endian and return the result in host order. On platforms where a swap is required ioread32/readl do the swap internally (eg see ppc). Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Acked-by: Peter Huewe <peterhuewe@gmx.de>
* tpm_crb: Use the common ACPI definition of struct acpi_tpm2Jason Gunthorpe2016-02-09
| | | | | | | | | | | | | | | | include/acpi/actbl2.h is the proper place for these definitions and the needed TPM2 ones have been there since commit 413d4a6defe0 ("ACPICA: Update TPM2 ACPI table") This also drops a couple of le32_to_cpu's for members of this table, the existing swapping was not done consistently, and the standard used by other Linux callers of acpi_get_table is unswapped. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Tested-by: Wilck, Martin <martin.wilck@ts.fujitsu.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Acked-by: Peter Huewe <peterhuewe@gmx.de>
* tpm: rework tpm_get_timeouts()Jason Gunthorpe2015-12-20
| | | | | | | | | | | | | | | | | | | | | IRQ probing needs to know that the TPM is working before trying to probe, so move tpm_get_timeouts() to the top of the tpm_tis_init(). This has the advantage of also getting the correct timeouts loaded before doing IRQ probing. All the timeout handling code is moved to tpm_get_timeouts() in order to remove duplicate code in tpm_tis and tpm_crb. [jarkko.sakkinen@linux.intel.com: squashed two patches together and improved the commit message.] Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Martin Wilck <Martin.Wilck@ts.fujitsu.com> Tested-by: Scot Doyle <lkml14@scotdoyle.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Acked-by: Peter Huewe <peterhuewe@gmx.de>
* tpm, tpm_tis: fix tpm_tis ACPI detection issue with TPM 2.0Jarkko Sakkinen2015-10-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both for FIFO and CRB interface TCG has decided to use the same HID MSFT0101. They can be differentiated by looking at the start method from TPM2 ACPI table. This patches makes necessary fixes to tpm_tis and tpm_crb modules in order to correctly detect, which module should be used. For MSFT0101 we must use struct acpi_driver because struct pnp_driver has a 7 character limitation. It turned out that the root cause in b371616b8 was not correct for https://bugzilla.kernel.org/show_bug.cgi?id=98181. v2: * One fixup was missing from v1: is_tpm2_fifo -> is_fifo v3: * Use pnp_driver for existing HIDs and acpi_driver only for MSFT0101 in order ensure backwards compatibility. v4: * Check for FIFO before doing *anything* in crb_acpi_add(). * There was return immediately after acpi_bus_unregister_driver() in cleanup_tis(). This caused pnp_unregister_driver() not to be called. Cc: stable@kernel.org Reported-by: Michael Saunders <mick.saunders@gmail.com> Reported-by: Michael Marley <michael@michaelmarley.com> Reported-by: Jethro Beekman <kernel@jbeekman.nl> Reported-by: Matthew Garrett <mjg59@srcf.ucam.org> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Michael Marley <michael@michaelmarley.com> Tested-by: Mimi Zohar <zohar@linux.vnet.ibm.com> (on TPM 1.2) Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* tpm, tpm_crb: fix unaligned read of the command buffer addressJarkko Sakkinen2015-10-18
| | | | | | | | | | | | | | | | The command buffer address must be read with exactly two 32-bit reads. Otherwise, on some HW platforms, it seems that HW will abort the read operation, which causes CPU to fill the read bytes with 1's. Therefore, we cannot rely on memcpy_fromio() but must call ioread32() two times instead. Also, this matches the PC Client Platform TPM Profile specification, which defines command buffer address with two 32-bit fields. Cc: stable@kernel.org Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* tpm, tpm_crb: fail when TPM2 ACPI table contents look corruptedJarkko Sakkinen2015-07-13
| | | | | | | | | | | | | | At least some versions of AMI BIOS have corrupted contents in the TPM2 ACPI table and namely the physical address of the control area is set to zero. This patch changes the driver to fail gracefully when we observe a zero address instead of continuing to ioremap. Cc: <stable@vger.kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* tpm, tpm_crb: fix le64_to_cpu conversions in crb_acpi_add()Jarkko Sakkinen2015-06-16
| | | | | | | | | | | | | le64_to_cpu() was applied twice to the physical addresses read from the control area. This hasn't shown any visible regressions because CRB driver has been tested only on the little endian platofrms so far. Reported-by: Matt Fleming <matt.fleming@intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-By: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Cc: <stable@vger.kernel.org> Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface") Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* tpm: fix suspend/resume paths for TPM 2.0Jarkko Sakkinen2015-02-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixed suspend/resume paths for TPM 2.0 and consolidated all the associated code to the tpm_pm_suspend() and tpm_pm_resume() functions. Resume path should be handled by the firmware, i.e. Startup(CLEAR) for hibernate and Startup(STATE) for suspend. There might be some non-PC embedded devices in the future where Startup() is not the handled by the FW but fixing the code for those IMHO should be postponed until there is hardware available to test the fixes although extra Startup in the driver code is essentially a NOP. Added Shutdown(CLEAR) to the remove paths of TIS and CRB drivers. Changed tpm2_shutdown() to a void function because there isn't much you can do except print an error message if this fails with a system error. Fixes: aec04cbdf723 ("tpm: TPM 2.0 FIFO Interface") Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface") [phuewe: both did send TPM_Shutdown on resume which 'disables' the TPM and did not send TPM2_Shutdown on teardown which leads some TPM2.0 to believe there was an attack (no TPM2_Shutdown = no orderly shutdown = attack)] Reported-by: Peter Hüwe <PeterHuewe@gmx.de> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by: Scot Doyle <lkml14@scotdoyle.com> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* char/tpm/tpm_crb: fix build errorJarkko Sakkinen2015-01-19
| | | | | | | | SIMPLE_DEV_PM_OPS() was inside #ifdef CONFIG_PM_SLEEP. Fixes: 30fc8d1 ("tpm: TPM 2.0 CRB Interface") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
* tpm: TPM 2.0 CRB InterfaceJarkko Sakkinen2015-01-17
tpm_crb is a driver for TPM 2.0 Command Response Buffer (CRB) Interface as defined in PC Client Platform TPM Profile (PTP) Specification. Only polling and single locality is supported as these are the limitations of the available hardware, Platform Trust Techonlogy (PTT) in Haswell CPUs. The driver always applies CRB with ACPI start because PTT reports using only ACPI start as start method but as a result of my testing it requires also CRB start. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jasob Gunthorpe <jason.gunthorpe@obsidianresearch.com> Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
generated by cgit v1.2.2 (git 2.25.0) at 2025-04-04 01:50:08 -0400