2 * tpm_tis.c - QEMU's TPM TIS interface emulator
4 * Copyright (C) 2006,2010-2013 IBM Corporation
7 * Stefan Berger <stefanb@us.ibm.com>
8 * David Safford <safford@us.ibm.com>
10 * Xen 4 support: Andrease Niederl <andreas.niederl@iaik.tugraz.at>
12 * This work is licensed under the terms of the GNU GPL, version 2 or later.
13 * See the COPYING file in the top-level directory.
15 * Implementation of the TIS interface according to specs found at
16 * http://www.trustedcomputinggroup.org. This implementation currently
17 * supports version 1.3, 21 March 2013
18 * In the developers menu choose the PC Client section then find the TIS
21 * TPM TIS for TPM 2 implementation following TCG PC Client Platform
22 * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
25 #include "qemu/osdep.h"
27 #include "hw/isa/isa.h"
28 #include "qapi/error.h"
29 #include "qemu/module.h"
31 #include "hw/acpi/tpm.h"
32 #include "hw/pci/pci_ids.h"
33 #include "hw/qdev-properties.h"
34 #include "migration/vmstate.h"
35 #include "sysemu/tpm_backend.h"
41 #define TPM_TIS_NUM_LOCALITIES 5 /* per spec */
42 #define TPM_TIS_LOCALITY_SHIFT 12
43 #define TPM_TIS_NO_LOCALITY 0xff
45 #define TPM_TIS_IS_VALID_LOCTY(x) ((x) < TPM_TIS_NUM_LOCALITIES)
47 #define TPM_TIS_BUFFER_MAX 4096
50 TPM_TIS_STATE_IDLE
= 0,
52 TPM_TIS_STATE_COMPLETION
,
53 TPM_TIS_STATE_EXECUTION
,
54 TPM_TIS_STATE_RECEPTION
,
57 /* locality data -- all fields are persisted */
58 typedef struct TPMLocality
{
67 typedef struct TPMState
{
71 unsigned char buffer
[TPM_TIS_BUFFER_MAX
];
75 uint8_t aborting_locty
;
78 TPMLocality loc
[TPM_TIS_NUM_LOCALITIES
];
85 TPMBackend
*be_driver
;
86 TPMVersion be_tpm_version
;
88 size_t be_buffer_size
;
94 #define TPM(obj) OBJECT_CHECK(TPMState, (obj), TYPE_TPM_TIS)
98 /* local prototypes */
100 static uint64_t tpm_tis_mmio_read(void *opaque
, hwaddr addr
,
103 /* utility functions */
105 static uint8_t tpm_tis_locality_from_addr(hwaddr addr
)
107 return (uint8_t)((addr
>> TPM_TIS_LOCALITY_SHIFT
) & 0x7);
110 static void tpm_tis_show_buffer(const unsigned char *buffer
,
111 size_t buffer_size
, const char *string
)
114 char *line_buffer
, *p
;
116 len
= MIN(tpm_cmd_get_size(buffer
), buffer_size
);
119 * allocate enough room for 3 chars per buffer entry plus a
120 * newline after every 16 chars and a final null terminator.
122 line_buffer
= g_malloc(len
* 3 + (len
/ 16) + 1);
124 for (i
= 0, p
= line_buffer
; i
< len
; i
++) {
125 if (i
&& !(i
% 16)) {
126 p
+= sprintf(p
, "\n");
128 p
+= sprintf(p
, "%.2X ", buffer
[i
]);
130 trace_tpm_tis_show_buffer(string
, len
, line_buffer
);
136 * Set the given flags in the STS register by clearing the register but
137 * preserving the SELFTEST_DONE and TPM_FAMILY_MASK flags and then setting
140 * The SELFTEST_DONE flag is acquired from the backend that determines it by
141 * peeking into TPM commands.
143 * A VM suspend/resume will preserve the flag by storing it into the VM
144 * device state, but the backend will not remember it when QEMU is started
145 * again. Therefore, we cache the flag here. Once set, it will not be unset
148 static void tpm_tis_sts_set(TPMLocality
*l
, uint32_t flags
)
150 l
->sts
&= TPM_TIS_STS_SELFTEST_DONE
| TPM_TIS_STS_TPM_FAMILY_MASK
;
155 * Send a request to the TPM.
157 static void tpm_tis_tpm_send(TPMState
*s
, uint8_t locty
)
159 if (trace_event_get_state_backends(TRACE_TPM_TIS_SHOW_BUFFER
)) {
160 tpm_tis_show_buffer(s
->buffer
, s
->be_buffer_size
, "To TPM");
164 * rw_offset serves as length indicator for length of data;
165 * it's reset when the response comes back
167 s
->loc
[locty
].state
= TPM_TIS_STATE_EXECUTION
;
169 s
->cmd
= (TPMBackendCmd
) {
172 .in_len
= s
->rw_offset
,
174 .out_len
= s
->be_buffer_size
,
177 tpm_backend_deliver_request(s
->be_driver
, &s
->cmd
);
180 /* raise an interrupt if allowed */
181 static void tpm_tis_raise_irq(TPMState
*s
, uint8_t locty
, uint32_t irqmask
)
183 if (!TPM_TIS_IS_VALID_LOCTY(locty
)) {
187 if ((s
->loc
[locty
].inte
& TPM_TIS_INT_ENABLED
) &&
188 (s
->loc
[locty
].inte
& irqmask
)) {
189 trace_tpm_tis_raise_irq(irqmask
);
190 qemu_irq_raise(s
->irq
);
191 s
->loc
[locty
].ints
|= irqmask
;
195 static uint32_t tpm_tis_check_request_use_except(TPMState
*s
, uint8_t locty
)
199 for (l
= 0; l
< TPM_TIS_NUM_LOCALITIES
; l
++) {
203 if ((s
->loc
[l
].access
& TPM_TIS_ACCESS_REQUEST_USE
)) {
211 static void tpm_tis_new_active_locality(TPMState
*s
, uint8_t new_active_locty
)
213 bool change
= (s
->active_locty
!= new_active_locty
);
217 if (change
&& TPM_TIS_IS_VALID_LOCTY(s
->active_locty
)) {
218 is_seize
= TPM_TIS_IS_VALID_LOCTY(new_active_locty
) &&
219 s
->loc
[new_active_locty
].access
& TPM_TIS_ACCESS_SEIZE
;
222 mask
= ~(TPM_TIS_ACCESS_ACTIVE_LOCALITY
);
224 mask
= ~(TPM_TIS_ACCESS_ACTIVE_LOCALITY
|
225 TPM_TIS_ACCESS_REQUEST_USE
);
227 /* reset flags on the old active locality */
228 s
->loc
[s
->active_locty
].access
&= mask
;
231 s
->loc
[s
->active_locty
].access
|= TPM_TIS_ACCESS_BEEN_SEIZED
;
235 s
->active_locty
= new_active_locty
;
237 trace_tpm_tis_new_active_locality(s
->active_locty
);
239 if (TPM_TIS_IS_VALID_LOCTY(new_active_locty
)) {
240 /* set flags on the new active locality */
241 s
->loc
[new_active_locty
].access
|= TPM_TIS_ACCESS_ACTIVE_LOCALITY
;
242 s
->loc
[new_active_locty
].access
&= ~(TPM_TIS_ACCESS_REQUEST_USE
|
243 TPM_TIS_ACCESS_SEIZE
);
247 tpm_tis_raise_irq(s
, s
->active_locty
, TPM_TIS_INT_LOCALITY_CHANGED
);
251 /* abort -- this function switches the locality */
252 static void tpm_tis_abort(TPMState
*s
)
256 trace_tpm_tis_abort(s
->next_locty
);
259 * Need to react differently depending on who's aborting now and
260 * which locality will become active afterwards.
262 if (s
->aborting_locty
== s
->next_locty
) {
263 s
->loc
[s
->aborting_locty
].state
= TPM_TIS_STATE_READY
;
264 tpm_tis_sts_set(&s
->loc
[s
->aborting_locty
],
265 TPM_TIS_STS_COMMAND_READY
);
266 tpm_tis_raise_irq(s
, s
->aborting_locty
, TPM_TIS_INT_COMMAND_READY
);
269 /* locality after abort is another one than the current one */
270 tpm_tis_new_active_locality(s
, s
->next_locty
);
272 s
->next_locty
= TPM_TIS_NO_LOCALITY
;
273 /* nobody's aborting a command anymore */
274 s
->aborting_locty
= TPM_TIS_NO_LOCALITY
;
277 /* prepare aborting current command */
278 static void tpm_tis_prep_abort(TPMState
*s
, uint8_t locty
, uint8_t newlocty
)
282 assert(TPM_TIS_IS_VALID_LOCTY(newlocty
));
284 s
->aborting_locty
= locty
; /* may also be TPM_TIS_NO_LOCALITY */
285 s
->next_locty
= newlocty
; /* locality after successful abort */
288 * only abort a command using an interrupt if currently executing
289 * a command AND if there's a valid connection to the vTPM.
291 for (busy_locty
= 0; busy_locty
< TPM_TIS_NUM_LOCALITIES
; busy_locty
++) {
292 if (s
->loc
[busy_locty
].state
== TPM_TIS_STATE_EXECUTION
) {
294 * request the backend to cancel. Some backends may not
297 tpm_backend_cancel_cmd(s
->be_driver
);
306 * Callback from the TPM to indicate that the response was received.
308 static void tpm_tis_request_completed(TPMIf
*ti
, int ret
)
310 TPMState
*s
= TPM(ti
);
311 uint8_t locty
= s
->cmd
.locty
;
314 assert(TPM_TIS_IS_VALID_LOCTY(locty
));
316 if (s
->cmd
.selftest_done
) {
317 for (l
= 0; l
< TPM_TIS_NUM_LOCALITIES
; l
++) {
318 s
->loc
[l
].sts
|= TPM_TIS_STS_SELFTEST_DONE
;
322 /* FIXME: report error if ret != 0 */
323 tpm_tis_sts_set(&s
->loc
[locty
],
324 TPM_TIS_STS_VALID
| TPM_TIS_STS_DATA_AVAILABLE
);
325 s
->loc
[locty
].state
= TPM_TIS_STATE_COMPLETION
;
328 if (trace_event_get_state_backends(TRACE_TPM_TIS_SHOW_BUFFER
)) {
329 tpm_tis_show_buffer(s
->buffer
, s
->be_buffer_size
, "From TPM");
332 if (TPM_TIS_IS_VALID_LOCTY(s
->next_locty
)) {
336 tpm_tis_raise_irq(s
, locty
,
337 TPM_TIS_INT_DATA_AVAILABLE
| TPM_TIS_INT_STS_VALID
);
341 * Read a byte of response data
343 static uint32_t tpm_tis_data_read(TPMState
*s
, uint8_t locty
)
345 uint32_t ret
= TPM_TIS_NO_DATA_BYTE
;
348 if ((s
->loc
[locty
].sts
& TPM_TIS_STS_DATA_AVAILABLE
)) {
349 len
= MIN(tpm_cmd_get_size(&s
->buffer
),
352 ret
= s
->buffer
[s
->rw_offset
++];
353 if (s
->rw_offset
>= len
) {
355 tpm_tis_sts_set(&s
->loc
[locty
], TPM_TIS_STS_VALID
);
356 tpm_tis_raise_irq(s
, locty
, TPM_TIS_INT_STS_VALID
);
358 trace_tpm_tis_data_read(ret
, s
->rw_offset
- 1);
365 static void tpm_tis_dump_state(void *opaque
, hwaddr addr
)
367 static const unsigned regs
[] = {
369 TPM_TIS_REG_INT_ENABLE
,
370 TPM_TIS_REG_INT_VECTOR
,
371 TPM_TIS_REG_INT_STATUS
,
372 TPM_TIS_REG_INTF_CAPABILITY
,
378 uint8_t locty
= tpm_tis_locality_from_addr(addr
);
379 hwaddr base
= addr
& ~0xfff;
380 TPMState
*s
= opaque
;
382 printf("tpm_tis: active locality : %d\n"
383 "tpm_tis: state of locality %d : %d\n"
384 "tpm_tis: register dump:\n",
386 locty
, s
->loc
[locty
].state
);
388 for (idx
= 0; regs
[idx
] != 0xfff; idx
++) {
389 printf("tpm_tis: 0x%04x : 0x%08x\n", regs
[idx
],
390 (int)tpm_tis_mmio_read(opaque
, base
+ regs
[idx
], 4));
393 printf("tpm_tis: r/w offset : %d\n"
394 "tpm_tis: result buffer : ",
397 idx
< MIN(tpm_cmd_get_size(&s
->buffer
), s
->be_buffer_size
);
400 s
->rw_offset
== idx
? '>' : ' ',
402 ((idx
& 0xf) == 0xf) ? "\ntpm_tis: " : "");
409 * Read a register of the TIS interface
410 * See specs pages 33-63 for description of the registers
412 static uint64_t tpm_tis_mmio_read(void *opaque
, hwaddr addr
,
415 TPMState
*s
= opaque
;
416 uint16_t offset
= addr
& 0xffc;
417 uint8_t shift
= (addr
& 0x3) * 8;
418 uint32_t val
= 0xffffffff;
419 uint8_t locty
= tpm_tis_locality_from_addr(addr
);
423 if (tpm_backend_had_startup_error(s
->be_driver
)) {
428 case TPM_TIS_REG_ACCESS
:
429 /* never show the SEIZE flag even though we use it internally */
430 val
= s
->loc
[locty
].access
& ~TPM_TIS_ACCESS_SEIZE
;
431 /* the pending flag is always calculated */
432 if (tpm_tis_check_request_use_except(s
, locty
)) {
433 val
|= TPM_TIS_ACCESS_PENDING_REQUEST
;
435 val
|= !tpm_backend_get_tpm_established_flag(s
->be_driver
);
437 case TPM_TIS_REG_INT_ENABLE
:
438 val
= s
->loc
[locty
].inte
;
440 case TPM_TIS_REG_INT_VECTOR
:
443 case TPM_TIS_REG_INT_STATUS
:
444 val
= s
->loc
[locty
].ints
;
446 case TPM_TIS_REG_INTF_CAPABILITY
:
447 switch (s
->be_tpm_version
) {
448 case TPM_VERSION_UNSPEC
:
451 case TPM_VERSION_1_2
:
452 val
= TPM_TIS_CAPABILITIES_SUPPORTED1_3
;
454 case TPM_VERSION_2_0
:
455 val
= TPM_TIS_CAPABILITIES_SUPPORTED2_0
;
459 case TPM_TIS_REG_STS
:
460 if (s
->active_locty
== locty
) {
461 if ((s
->loc
[locty
].sts
& TPM_TIS_STS_DATA_AVAILABLE
)) {
462 val
= TPM_TIS_BURST_COUNT(
463 MIN(tpm_cmd_get_size(&s
->buffer
),
465 - s
->rw_offset
) | s
->loc
[locty
].sts
;
467 avail
= s
->be_buffer_size
- s
->rw_offset
;
469 * byte-sized reads should not return 0x00 for 0x100
472 if (size
== 1 && avail
> 0xff) {
475 val
= TPM_TIS_BURST_COUNT(avail
) | s
->loc
[locty
].sts
;
479 case TPM_TIS_REG_DATA_FIFO
:
480 case TPM_TIS_REG_DATA_XFIFO
... TPM_TIS_REG_DATA_XFIFO_END
:
481 if (s
->active_locty
== locty
) {
482 if (size
> 4 - (addr
& 0x3)) {
483 /* prevent access beyond FIFO */
484 size
= 4 - (addr
& 0x3);
489 switch (s
->loc
[locty
].state
) {
490 case TPM_TIS_STATE_COMPLETION
:
491 v
= tpm_tis_data_read(s
, locty
);
494 v
= TPM_TIS_NO_DATA_BYTE
;
501 shift
= 0; /* no more adjustments */
504 case TPM_TIS_REG_INTERFACE_ID
:
505 val
= s
->loc
[locty
].iface_id
;
507 case TPM_TIS_REG_DID_VID
:
508 val
= (TPM_TIS_TPM_DID
<< 16) | TPM_TIS_TPM_VID
;
510 case TPM_TIS_REG_RID
:
511 val
= TPM_TIS_TPM_RID
;
514 case TPM_TIS_REG_DEBUG
:
515 tpm_tis_dump_state(opaque
, addr
);
524 trace_tpm_tis_mmio_read(size
, addr
, val
);
530 * Write a value to a register of the TIS interface
531 * See specs pages 33-63 for description of the registers
533 static void tpm_tis_mmio_write(void *opaque
, hwaddr addr
,
534 uint64_t val
, unsigned size
)
536 TPMState
*s
= opaque
;
537 uint16_t off
= addr
& 0xffc;
538 uint8_t shift
= (addr
& 0x3) * 8;
539 uint8_t locty
= tpm_tis_locality_from_addr(addr
);
540 uint8_t active_locty
, l
;
541 int c
, set_new_locty
= 1;
543 uint32_t mask
= (size
== 1) ? 0xff : ((size
== 2) ? 0xffff : ~0);
545 trace_tpm_tis_mmio_write(size
, addr
, val
);
548 trace_tpm_tis_mmio_write_locty4();
552 if (tpm_backend_had_startup_error(s
->be_driver
)) {
566 case TPM_TIS_REG_ACCESS
:
568 if ((val
& TPM_TIS_ACCESS_SEIZE
)) {
569 val
&= ~(TPM_TIS_ACCESS_REQUEST_USE
|
570 TPM_TIS_ACCESS_ACTIVE_LOCALITY
);
573 active_locty
= s
->active_locty
;
575 if ((val
& TPM_TIS_ACCESS_ACTIVE_LOCALITY
)) {
576 /* give up locality if currently owned */
577 if (s
->active_locty
== locty
) {
578 trace_tpm_tis_mmio_write_release_locty(locty
);
580 uint8_t newlocty
= TPM_TIS_NO_LOCALITY
;
581 /* anybody wants the locality ? */
582 for (c
= TPM_TIS_NUM_LOCALITIES
- 1; c
>= 0; c
--) {
583 if ((s
->loc
[c
].access
& TPM_TIS_ACCESS_REQUEST_USE
)) {
584 trace_tpm_tis_mmio_write_locty_req_use(c
);
589 trace_tpm_tis_mmio_write_next_locty(newlocty
);
591 if (TPM_TIS_IS_VALID_LOCTY(newlocty
)) {
593 tpm_tis_prep_abort(s
, locty
, newlocty
);
595 active_locty
= TPM_TIS_NO_LOCALITY
;
598 /* not currently the owner; clear a pending request */
599 s
->loc
[locty
].access
&= ~TPM_TIS_ACCESS_REQUEST_USE
;
603 if ((val
& TPM_TIS_ACCESS_BEEN_SEIZED
)) {
604 s
->loc
[locty
].access
&= ~TPM_TIS_ACCESS_BEEN_SEIZED
;
607 if ((val
& TPM_TIS_ACCESS_SEIZE
)) {
609 * allow seize if a locality is active and the requesting
610 * locality is higher than the one that's active
612 * allow seize for requesting locality if no locality is
615 while ((TPM_TIS_IS_VALID_LOCTY(s
->active_locty
) &&
616 locty
> s
->active_locty
) ||
617 !TPM_TIS_IS_VALID_LOCTY(s
->active_locty
)) {
618 bool higher_seize
= FALSE
;
620 /* already a pending SEIZE ? */
621 if ((s
->loc
[locty
].access
& TPM_TIS_ACCESS_SEIZE
)) {
625 /* check for ongoing seize by a higher locality */
626 for (l
= locty
+ 1; l
< TPM_TIS_NUM_LOCALITIES
; l
++) {
627 if ((s
->loc
[l
].access
& TPM_TIS_ACCESS_SEIZE
)) {
637 /* cancel any seize by a lower locality */
638 for (l
= 0; l
< locty
; l
++) {
639 s
->loc
[l
].access
&= ~TPM_TIS_ACCESS_SEIZE
;
642 s
->loc
[locty
].access
|= TPM_TIS_ACCESS_SEIZE
;
644 trace_tpm_tis_mmio_write_locty_seized(locty
, s
->active_locty
);
645 trace_tpm_tis_mmio_write_init_abort();
648 tpm_tis_prep_abort(s
, s
->active_locty
, locty
);
653 if ((val
& TPM_TIS_ACCESS_REQUEST_USE
)) {
654 if (s
->active_locty
!= locty
) {
655 if (TPM_TIS_IS_VALID_LOCTY(s
->active_locty
)) {
656 s
->loc
[locty
].access
|= TPM_TIS_ACCESS_REQUEST_USE
;
658 /* no locality active -> make this one active now */
659 active_locty
= locty
;
665 tpm_tis_new_active_locality(s
, active_locty
);
669 case TPM_TIS_REG_INT_ENABLE
:
670 if (s
->active_locty
!= locty
) {
674 s
->loc
[locty
].inte
&= mask
;
675 s
->loc
[locty
].inte
|= (val
& (TPM_TIS_INT_ENABLED
|
676 TPM_TIS_INT_POLARITY_MASK
|
677 TPM_TIS_INTERRUPTS_SUPPORTED
));
679 case TPM_TIS_REG_INT_VECTOR
:
680 /* hard wired -- ignore */
682 case TPM_TIS_REG_INT_STATUS
:
683 if (s
->active_locty
!= locty
) {
687 /* clearing of interrupt flags */
688 if (((val
& TPM_TIS_INTERRUPTS_SUPPORTED
)) &&
689 (s
->loc
[locty
].ints
& TPM_TIS_INTERRUPTS_SUPPORTED
)) {
690 s
->loc
[locty
].ints
&= ~val
;
691 if (s
->loc
[locty
].ints
== 0) {
692 qemu_irq_lower(s
->irq
);
693 trace_tpm_tis_mmio_write_lowering_irq();
696 s
->loc
[locty
].ints
&= ~(val
& TPM_TIS_INTERRUPTS_SUPPORTED
);
698 case TPM_TIS_REG_STS
:
699 if (s
->active_locty
!= locty
) {
703 if (s
->be_tpm_version
== TPM_VERSION_2_0
) {
704 /* some flags that are only supported for TPM 2 */
705 if (val
& TPM_TIS_STS_COMMAND_CANCEL
) {
706 if (s
->loc
[locty
].state
== TPM_TIS_STATE_EXECUTION
) {
708 * request the backend to cancel. Some backends may not
711 tpm_backend_cancel_cmd(s
->be_driver
);
715 if (val
& TPM_TIS_STS_RESET_ESTABLISHMENT_BIT
) {
716 if (locty
== 3 || locty
== 4) {
717 tpm_backend_reset_tpm_established_flag(s
->be_driver
, locty
);
722 val
&= (TPM_TIS_STS_COMMAND_READY
| TPM_TIS_STS_TPM_GO
|
723 TPM_TIS_STS_RESPONSE_RETRY
);
725 if (val
== TPM_TIS_STS_COMMAND_READY
) {
726 switch (s
->loc
[locty
].state
) {
728 case TPM_TIS_STATE_READY
:
732 case TPM_TIS_STATE_IDLE
:
733 tpm_tis_sts_set(&s
->loc
[locty
], TPM_TIS_STS_COMMAND_READY
);
734 s
->loc
[locty
].state
= TPM_TIS_STATE_READY
;
735 tpm_tis_raise_irq(s
, locty
, TPM_TIS_INT_COMMAND_READY
);
738 case TPM_TIS_STATE_EXECUTION
:
739 case TPM_TIS_STATE_RECEPTION
:
740 /* abort currently running command */
741 trace_tpm_tis_mmio_write_init_abort();
742 tpm_tis_prep_abort(s
, locty
, locty
);
745 case TPM_TIS_STATE_COMPLETION
:
747 /* shortcut to ready state with C/R set */
748 s
->loc
[locty
].state
= TPM_TIS_STATE_READY
;
749 if (!(s
->loc
[locty
].sts
& TPM_TIS_STS_COMMAND_READY
)) {
750 tpm_tis_sts_set(&s
->loc
[locty
],
751 TPM_TIS_STS_COMMAND_READY
);
752 tpm_tis_raise_irq(s
, locty
, TPM_TIS_INT_COMMAND_READY
);
754 s
->loc
[locty
].sts
&= ~(TPM_TIS_STS_DATA_AVAILABLE
);
758 } else if (val
== TPM_TIS_STS_TPM_GO
) {
759 switch (s
->loc
[locty
].state
) {
760 case TPM_TIS_STATE_RECEPTION
:
761 if ((s
->loc
[locty
].sts
& TPM_TIS_STS_EXPECT
) == 0) {
762 tpm_tis_tpm_send(s
, locty
);
769 } else if (val
== TPM_TIS_STS_RESPONSE_RETRY
) {
770 switch (s
->loc
[locty
].state
) {
771 case TPM_TIS_STATE_COMPLETION
:
773 tpm_tis_sts_set(&s
->loc
[locty
],
775 TPM_TIS_STS_DATA_AVAILABLE
);
783 case TPM_TIS_REG_DATA_FIFO
:
784 case TPM_TIS_REG_DATA_XFIFO
... TPM_TIS_REG_DATA_XFIFO_END
:
786 if (s
->active_locty
!= locty
) {
790 if (s
->loc
[locty
].state
== TPM_TIS_STATE_IDLE
||
791 s
->loc
[locty
].state
== TPM_TIS_STATE_EXECUTION
||
792 s
->loc
[locty
].state
== TPM_TIS_STATE_COMPLETION
) {
795 trace_tpm_tis_mmio_write_data2send(val
, size
);
796 if (s
->loc
[locty
].state
== TPM_TIS_STATE_READY
) {
797 s
->loc
[locty
].state
= TPM_TIS_STATE_RECEPTION
;
798 tpm_tis_sts_set(&s
->loc
[locty
],
799 TPM_TIS_STS_EXPECT
| TPM_TIS_STS_VALID
);
803 if (size
> 4 - (addr
& 0x3)) {
804 /* prevent access beyond FIFO */
805 size
= 4 - (addr
& 0x3);
808 while ((s
->loc
[locty
].sts
& TPM_TIS_STS_EXPECT
) && size
> 0) {
809 if (s
->rw_offset
< s
->be_buffer_size
) {
810 s
->buffer
[s
->rw_offset
++] =
815 tpm_tis_sts_set(&s
->loc
[locty
], TPM_TIS_STS_VALID
);
819 /* check for complete packet */
820 if (s
->rw_offset
> 5 &&
821 (s
->loc
[locty
].sts
& TPM_TIS_STS_EXPECT
)) {
822 /* we have a packet length - see if we have all of it */
823 bool need_irq
= !(s
->loc
[locty
].sts
& TPM_TIS_STS_VALID
);
825 len
= tpm_cmd_get_size(&s
->buffer
);
826 if (len
> s
->rw_offset
) {
827 tpm_tis_sts_set(&s
->loc
[locty
],
828 TPM_TIS_STS_EXPECT
| TPM_TIS_STS_VALID
);
830 /* packet complete */
831 tpm_tis_sts_set(&s
->loc
[locty
], TPM_TIS_STS_VALID
);
834 tpm_tis_raise_irq(s
, locty
, TPM_TIS_INT_STS_VALID
);
839 case TPM_TIS_REG_INTERFACE_ID
:
840 if (val
& TPM_TIS_IFACE_ID_INT_SEL_LOCK
) {
841 for (l
= 0; l
< TPM_TIS_NUM_LOCALITIES
; l
++) {
842 s
->loc
[l
].iface_id
|= TPM_TIS_IFACE_ID_INT_SEL_LOCK
;
849 static const MemoryRegionOps tpm_tis_memory_ops
= {
850 .read
= tpm_tis_mmio_read
,
851 .write
= tpm_tis_mmio_write
,
852 .endianness
= DEVICE_LITTLE_ENDIAN
,
854 .min_access_size
= 1,
855 .max_access_size
= 4,
860 * Get the TPMVersion of the backend device being used
862 static enum TPMVersion
tpm_tis_get_tpm_version(TPMIf
*ti
)
864 TPMState
*s
= TPM(ti
);
866 if (tpm_backend_had_startup_error(s
->be_driver
)) {
867 return TPM_VERSION_UNSPEC
;
870 return tpm_backend_get_tpm_version(s
->be_driver
);
874 * This function is called when the machine starts, resets or due to
877 static void tpm_tis_reset(DeviceState
*dev
)
879 TPMState
*s
= TPM(dev
);
882 s
->be_tpm_version
= tpm_backend_get_tpm_version(s
->be_driver
);
883 s
->be_buffer_size
= MIN(tpm_backend_get_buffer_size(s
->be_driver
),
886 if (s
->ppi_enabled
) {
887 tpm_ppi_reset(&s
->ppi
);
889 tpm_backend_reset(s
->be_driver
);
891 s
->active_locty
= TPM_TIS_NO_LOCALITY
;
892 s
->next_locty
= TPM_TIS_NO_LOCALITY
;
893 s
->aborting_locty
= TPM_TIS_NO_LOCALITY
;
895 for (c
= 0; c
< TPM_TIS_NUM_LOCALITIES
; c
++) {
896 s
->loc
[c
].access
= TPM_TIS_ACCESS_TPM_REG_VALID_STS
;
897 switch (s
->be_tpm_version
) {
898 case TPM_VERSION_UNSPEC
:
900 case TPM_VERSION_1_2
:
901 s
->loc
[c
].sts
= TPM_TIS_STS_TPM_FAMILY1_2
;
902 s
->loc
[c
].iface_id
= TPM_TIS_IFACE_ID_SUPPORTED_FLAGS1_3
;
904 case TPM_VERSION_2_0
:
905 s
->loc
[c
].sts
= TPM_TIS_STS_TPM_FAMILY2_0
;
906 s
->loc
[c
].iface_id
= TPM_TIS_IFACE_ID_SUPPORTED_FLAGS2_0
;
909 s
->loc
[c
].inte
= TPM_TIS_INT_POLARITY_LOW_LEVEL
;
911 s
->loc
[c
].state
= TPM_TIS_STATE_IDLE
;
916 if (tpm_backend_startup_tpm(s
->be_driver
, s
->be_buffer_size
) < 0) {
921 /* persistent state handling */
923 static int tpm_tis_pre_save(void *opaque
)
925 TPMState
*s
= opaque
;
926 uint8_t locty
= s
->active_locty
;
928 trace_tpm_tis_pre_save(locty
, s
->rw_offset
);
931 tpm_tis_dump_state(opaque
, 0);
935 * Synchronize with backend completion.
937 tpm_backend_finish_sync(s
->be_driver
);
942 static const VMStateDescription vmstate_locty
= {
943 .name
= "tpm-tis/locty",
945 .fields
= (VMStateField
[]) {
946 VMSTATE_UINT32(state
, TPMLocality
),
947 VMSTATE_UINT32(inte
, TPMLocality
),
948 VMSTATE_UINT32(ints
, TPMLocality
),
949 VMSTATE_UINT8(access
, TPMLocality
),
950 VMSTATE_UINT32(sts
, TPMLocality
),
951 VMSTATE_UINT32(iface_id
, TPMLocality
),
952 VMSTATE_END_OF_LIST(),
956 static const VMStateDescription vmstate_tpm_tis
= {
959 .pre_save
= tpm_tis_pre_save
,
960 .fields
= (VMStateField
[]) {
961 VMSTATE_BUFFER(buffer
, TPMState
),
962 VMSTATE_UINT16(rw_offset
, TPMState
),
963 VMSTATE_UINT8(active_locty
, TPMState
),
964 VMSTATE_UINT8(aborting_locty
, TPMState
),
965 VMSTATE_UINT8(next_locty
, TPMState
),
967 VMSTATE_STRUCT_ARRAY(loc
, TPMState
, TPM_TIS_NUM_LOCALITIES
, 0,
968 vmstate_locty
, TPMLocality
),
970 VMSTATE_END_OF_LIST()
974 static Property tpm_tis_properties
[] = {
975 DEFINE_PROP_UINT32("irq", TPMState
, irq_num
, TPM_TIS_IRQ
),
976 DEFINE_PROP_TPMBE("tpmdev", TPMState
, be_driver
),
977 DEFINE_PROP_BOOL("ppi", TPMState
, ppi_enabled
, true),
978 DEFINE_PROP_END_OF_LIST(),
981 static void tpm_tis_realizefn(DeviceState
*dev
, Error
**errp
)
983 TPMState
*s
= TPM(dev
);
986 error_setg(errp
, "at most one TPM device is permitted");
991 error_setg(errp
, "'tpmdev' property is required");
994 if (s
->irq_num
> 15) {
995 error_setg(errp
, "IRQ %d is outside valid range of 0 to 15",
1000 isa_init_irq(&s
->busdev
, &s
->irq
, s
->irq_num
);
1002 memory_region_add_subregion(isa_address_space(ISA_DEVICE(dev
)),
1003 TPM_TIS_ADDR_BASE
, &s
->mmio
);
1005 if (s
->ppi_enabled
) {
1006 tpm_ppi_init(&s
->ppi
, isa_address_space(ISA_DEVICE(dev
)),
1007 TPM_PPI_ADDR_BASE
, OBJECT(s
));
1011 static void tpm_tis_initfn(Object
*obj
)
1013 TPMState
*s
= TPM(obj
);
1015 memory_region_init_io(&s
->mmio
, OBJECT(s
), &tpm_tis_memory_ops
,
1017 TPM_TIS_NUM_LOCALITIES
<< TPM_TIS_LOCALITY_SHIFT
);
1020 static void tpm_tis_class_init(ObjectClass
*klass
, void *data
)
1022 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1023 TPMIfClass
*tc
= TPM_IF_CLASS(klass
);
1025 dc
->realize
= tpm_tis_realizefn
;
1026 dc
->props
= tpm_tis_properties
;
1027 dc
->reset
= tpm_tis_reset
;
1028 dc
->vmsd
= &vmstate_tpm_tis
;
1029 tc
->model
= TPM_MODEL_TPM_TIS
;
1030 tc
->get_version
= tpm_tis_get_tpm_version
;
1031 tc
->request_completed
= tpm_tis_request_completed
;
1034 static const TypeInfo tpm_tis_info
= {
1035 .name
= TYPE_TPM_TIS
,
1036 .parent
= TYPE_ISA_DEVICE
,
1037 .instance_size
= sizeof(TPMState
),
1038 .instance_init
= tpm_tis_initfn
,
1039 .class_init
= tpm_tis_class_init
,
1040 .interfaces
= (InterfaceInfo
[]) {
1046 static void tpm_tis_register(void)
1048 type_register_static(&tpm_tis_info
);
1051 type_init(tpm_tis_register
)