From: Arun Menon <[email protected]> TPMs implemented with the CRB address map in the TCG PC-Client Platform TPM Profile (PTP) for TPM 2.0 are limited to a 3968-byte command/response buffer (v1.07, March 2026, Table 36 and section 6.5.3.9) in [2]. This is smaller than the 7.7KB ML-DSA-87 TPM2_Load from the previous patch. PTP 1.07 adds a chunking mode for exactly this case (sections 6.4.2.2, 6.5.3.9, 6.5.3.10 in [2]), usable by any CRB TPM that implements it.
Send and receive the command/response split into pieces no larger than priv->cmd_size/priv->rsp_size. Write CRB_START_NEXT_CHUNK to ctrl_start after each piece but the last, and wait for the TPM to clear it before sending the next; use CRB_START_INVOKE on the last piece, same as the non-chunked path. Read a response back the same way, in reverse. On top of the previous patch's tpm_crb_send_no_chunks()/ tpm_crb_recv_no_chunks() split, add: - rsp_size: response-direction counterpart of cmd_size. - intf_id: interface ID register, read once at probe time. - CRB_INTF_CAP_CRB_CHUNK: capability bit in intf_id; crb_send()/ crb_recv() only reject an oversized payload when it is clear. - tpm_crb_send_chunks()/tpm_crb_recv_chunks(): drive the chunked transfer described above. This corresponds to the backend implementation in QEMU [1], which reassembles the chunks before handing the command to the TPM emulator. [1] https://lore.kernel.org/qemu-devel/[email protected]/ [2] https://medias.cdn.trustedcomputinggroup.org/production/PC_Client_Specific_Platform_TPM_Profile_for_TPM_2p0_v1p07_Pub_5643562943.pdf Signed-off-by: Arun Menon <[email protected]> --- drivers/char/tpm/tpm_crb.c | 119 +++++++++++++++++++++++++++++++++++-- 1 file changed, 115 insertions(+), 4 deletions(-) diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c index f0bac9e1f1e8..e14b1feb3fea 100644 --- a/drivers/char/tpm/tpm_crb.c +++ b/drivers/char/tpm/tpm_crb.c @@ -105,11 +105,13 @@ struct crb_priv { u8 __iomem *cmd; u8 __iomem *rsp; u32 cmd_size; + u32 rsp_size; u32 smc_func_id; u32 __iomem *pluton_start_addr; u32 __iomem *pluton_reply_addr; u8 ffa_flags; u8 ffa_attributes; + u32 intf_id; }; struct tpm2_crb_smc { @@ -369,6 +371,13 @@ static u8 crb_status(struct tpm_chip *chip) return sts; } +/* + * tpm_crb_recv_chunks() below needs to drive CRB_START_NEXT_CHUNK through + * tpm_crb_start(), which is defined later in this file next to the other + * platform-specific start methods it dispatches to. + */ +static int tpm_crb_start(struct tpm_chip *chip, u32 start_cmd); + static int tpm_crb_recv_no_chunks(struct tpm_chip *chip, u8 *buf, size_t count) { struct crb_priv *priv = dev_get_drvdata(&chip->dev); @@ -388,12 +397,54 @@ static int tpm_crb_recv_no_chunks(struct tpm_chip *chip, u8 *buf, size_t count) memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8); return expected; +} + +static int tpm_crb_recv_chunks(struct tpm_chip *chip, u8 *buf, size_t count, + unsigned int expected) +{ + struct crb_priv *priv = dev_get_drvdata(&chip->dev); + size_t offset = 0; + size_t chunk_size; + bool expired; + int rc; + + if (expected > count || expected < TPM_HEADER_SIZE) + return -EIO; + /* + * Without this, a bogus zero-sized MMIO window would never make + * forward progress below. + */ + if (priv->rsp_size == 0) + return -EIO; + + while (offset < expected) { + chunk_size = min_t(size_t, expected - offset, priv->rsp_size); + memcpy_fromio(buf + offset, priv->rsp, chunk_size); + offset += chunk_size; + if (offset == expected) + break; + + rc = tpm_crb_start(chip, CRB_START_NEXT_CHUNK); + if (rc) + return rc; + + expired = !crb_wait_for_reg_32(&priv->regs_t->ctrl_start, + CRB_START_NEXT_CHUNK, 0, + TPM2_TIMEOUT_C); + if (expired) { + dev_err(&chip->dev, + "Timeout waiting for backend response\n"); + return -ETIME; + } + } + return expected; } static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) { struct crb_priv *priv = dev_get_drvdata(&chip->dev); + unsigned int expected; /* * A sanity check that the upper layer wants to get at least the header @@ -409,7 +460,17 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR) return -EIO; - return tpm_crb_recv_no_chunks(chip, buf, count); + /* Peek at the first 8 bytes to determine the response size */ + expected = be32_to_cpup((__be32 *)&priv->rsp[2]); + + if (expected <= priv->rsp_size) + return tpm_crb_recv_no_chunks(chip, buf, count); + if (!(priv->intf_id & CRB_INTF_CAP_CRB_CHUNK)) { + dev_err(&chip->dev, + "Response larger than MMIO and chunking not supported\n"); + return -EIO; + } + return tpm_crb_recv_chunks(chip, buf, count, expected); } static int crb_do_acpi_start(struct tpm_chip *chip) @@ -502,6 +563,46 @@ static int tpm_crb_send_no_chunks(struct tpm_chip *chip, u8 *buf, size_t len) return crb_try_pluton_doorbell(priv, false); } +static int tpm_crb_send_chunks(struct tpm_chip *chip, u8 *buf, size_t len) +{ + struct crb_priv *priv = dev_get_drvdata(&chip->dev); + size_t chunk_size; + size_t offset = 0; + int rc; + bool expired; + + while (offset < len) { + chunk_size = min_t(size_t, len - offset, priv->cmd_size); + if (chunk_size == 0) + break; + + memcpy_toio(priv->cmd, buf + offset, chunk_size); + offset += chunk_size; + + /* Make sure that cmd is populated before issuing start. */ + wmb(); + + if (offset < len) { + rc = tpm_crb_start(chip, CRB_START_NEXT_CHUNK); + if (rc) + return rc; + expired = !crb_wait_for_reg_32(&priv->regs_t->ctrl_start, + CRB_START_NEXT_CHUNK, 0, + TPM2_TIMEOUT_C); + if (expired) { + dev_err(&chip->dev, + "Timeout waiting for backend to consume chunk\n"); + return -ETIME; + } + } else { + rc = tpm_crb_start(chip, CRB_START_INVOKE); + if (rc) + return rc; + } + } + return crb_try_pluton_doorbell(priv, false); +} + static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len) { struct crb_priv *priv = dev_get_drvdata(&chip->dev); @@ -512,7 +613,7 @@ static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len) */ iowrite32(0, &priv->regs_t->ctrl_cancel); - if (len > priv->cmd_size) { + if (len > priv->cmd_size && !(priv->intf_id & CRB_INTF_CAP_CRB_CHUNK)) { dev_err(&chip->dev, "invalid command count value %zd %d\n", len, priv->cmd_size); return -E2BIG; @@ -522,7 +623,10 @@ static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len) if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) __crb_cmd_ready(&chip->dev, priv, chip->locality); - return tpm_crb_send_no_chunks(chip, buf, len); + if (len <= priv->cmd_size) + return tpm_crb_send_no_chunks(chip, buf, len); + + return tpm_crb_send_chunks(chip, buf, len); } static void crb_cancel(struct tpm_chip *chip) @@ -748,6 +852,11 @@ static int crb_map_io(struct device *dev, struct crb_priv *priv, ret = PTR_ERR(priv->cmd); goto out; } + if (priv->regs_h) + priv->intf_id = ioread32((u32 __iomem *)&priv->regs_h->intf_id); + + if (priv->intf_id & CRB_INTF_CAP_CRB_CHUNK) + dev_info(dev, "CRB Chunking is supported by backend\n"); memcpy_fromio(&__rsp_pa, &priv->regs_t->ctrl_rsp_pa, 8); rsp_pa = le64_to_cpu(__rsp_pa); @@ -786,8 +895,10 @@ static int crb_map_io(struct device *dev, struct crb_priv *priv, priv->rsp = priv->cmd; out: - if (!ret) + if (!ret) { priv->cmd_size = cmd_size; + priv->rsp_size = rsp_size; + } __crb_go_idle(dev, priv, 0); -- 2.56.0
