2 * tpm_tis.c - QEMU's TPM TIS interface emulator
4 * Copyright (C) 2006,2010-2013 IBM Corporation
7 * Stefan Berger <stefanb@us.ibm.com>
8 * David Safford <safford@us.ibm.com>
10 * Xen 4 support: Andrease Niederl <andreas.niederl@iaik.tugraz.at>
12 * This work is licensed under the terms of the GNU GPL, version 2 or later.
13 * See the COPYING file in the top-level directory.
15 * Implementation of the TIS interface according to specs found at
16 * http://www.trustedcomputinggroup.org. This implementation currently
17 * supports version 1.3, 21 March 2013
18 * In the developers menu choose the PC Client section then find the TIS
21 * TPM TIS for TPM 2 implementation following TCG PC Client Platform
22 * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
25 #include "qemu/osdep.h"
26 #include "hw/isa/isa.h"
27 #include "qapi/error.h"
29 #include "hw/acpi/tpm.h"
30 #include "hw/pci/pci_ids.h"
31 #include "sysemu/tpm_backend.h"
35 #define TPM_TIS_NUM_LOCALITIES 5 /* per spec */
36 #define TPM_TIS_LOCALITY_SHIFT 12
37 #define TPM_TIS_NO_LOCALITY 0xff
39 #define TPM_TIS_IS_VALID_LOCTY(x) ((x) < TPM_TIS_NUM_LOCALITIES)
41 #define TPM_TIS_BUFFER_MAX 4096
44 TPM_TIS_STATE_IDLE
= 0,
46 TPM_TIS_STATE_COMPLETION
,
47 TPM_TIS_STATE_EXECUTION
,
48 TPM_TIS_STATE_RECEPTION
,
51 typedef struct TPMSizedBuffer
{
56 /* locality data -- all fields are persisted */
57 typedef struct TPMLocality
{
66 typedef struct TPMState
{
70 unsigned char buffer
[TPM_TIS_BUFFER_MAX
];
75 uint8_t aborting_locty
;
78 TPMLocality loc
[TPM_TIS_NUM_LOCALITIES
];
85 TPMBackend
*be_driver
;
86 TPMVersion be_tpm_version
;
88 size_t be_buffer_size
;
91 #define TPM(obj) OBJECT_CHECK(TPMState, (obj), TYPE_TPM_TIS)
95 #define DPRINTF(fmt, ...) do { \
97 printf(fmt, ## __VA_ARGS__); \
102 #define TPM_TIS_REG_ACCESS 0x00
103 #define TPM_TIS_REG_INT_ENABLE 0x08
104 #define TPM_TIS_REG_INT_VECTOR 0x0c
105 #define TPM_TIS_REG_INT_STATUS 0x10
106 #define TPM_TIS_REG_INTF_CAPABILITY 0x14
107 #define TPM_TIS_REG_STS 0x18
108 #define TPM_TIS_REG_DATA_FIFO 0x24
109 #define TPM_TIS_REG_INTERFACE_ID 0x30
110 #define TPM_TIS_REG_DATA_XFIFO 0x80
111 #define TPM_TIS_REG_DATA_XFIFO_END 0xbc
112 #define TPM_TIS_REG_DID_VID 0xf00
113 #define TPM_TIS_REG_RID 0xf04
115 /* vendor-specific registers */
116 #define TPM_TIS_REG_DEBUG 0xf90
118 #define TPM_TIS_STS_TPM_FAMILY_MASK (0x3 << 26)/* TPM 2.0 */
119 #define TPM_TIS_STS_TPM_FAMILY1_2 (0 << 26) /* TPM 2.0 */
120 #define TPM_TIS_STS_TPM_FAMILY2_0 (1 << 26) /* TPM 2.0 */
121 #define TPM_TIS_STS_RESET_ESTABLISHMENT_BIT (1 << 25) /* TPM 2.0 */
122 #define TPM_TIS_STS_COMMAND_CANCEL (1 << 24) /* TPM 2.0 */
124 #define TPM_TIS_STS_VALID (1 << 7)
125 #define TPM_TIS_STS_COMMAND_READY (1 << 6)
126 #define TPM_TIS_STS_TPM_GO (1 << 5)
127 #define TPM_TIS_STS_DATA_AVAILABLE (1 << 4)
128 #define TPM_TIS_STS_EXPECT (1 << 3)
129 #define TPM_TIS_STS_SELFTEST_DONE (1 << 2)
130 #define TPM_TIS_STS_RESPONSE_RETRY (1 << 1)
132 #define TPM_TIS_BURST_COUNT_SHIFT 8
133 #define TPM_TIS_BURST_COUNT(X) \
134 ((X) << TPM_TIS_BURST_COUNT_SHIFT)
136 #define TPM_TIS_ACCESS_TPM_REG_VALID_STS (1 << 7)
137 #define TPM_TIS_ACCESS_ACTIVE_LOCALITY (1 << 5)
138 #define TPM_TIS_ACCESS_BEEN_SEIZED (1 << 4)
139 #define TPM_TIS_ACCESS_SEIZE (1 << 3)
140 #define TPM_TIS_ACCESS_PENDING_REQUEST (1 << 2)
141 #define TPM_TIS_ACCESS_REQUEST_USE (1 << 1)
142 #define TPM_TIS_ACCESS_TPM_ESTABLISHMENT (1 << 0)
144 #define TPM_TIS_INT_ENABLED (1 << 31)
145 #define TPM_TIS_INT_DATA_AVAILABLE (1 << 0)
146 #define TPM_TIS_INT_STS_VALID (1 << 1)
147 #define TPM_TIS_INT_LOCALITY_CHANGED (1 << 2)
148 #define TPM_TIS_INT_COMMAND_READY (1 << 7)
150 #define TPM_TIS_INT_POLARITY_MASK (3 << 3)
151 #define TPM_TIS_INT_POLARITY_LOW_LEVEL (1 << 3)
153 #define TPM_TIS_INTERRUPTS_SUPPORTED (TPM_TIS_INT_LOCALITY_CHANGED | \
154 TPM_TIS_INT_DATA_AVAILABLE | \
155 TPM_TIS_INT_STS_VALID | \
156 TPM_TIS_INT_COMMAND_READY)
158 #define TPM_TIS_CAP_INTERFACE_VERSION1_3 (2 << 28)
159 #define TPM_TIS_CAP_INTERFACE_VERSION1_3_FOR_TPM2_0 (3 << 28)
160 #define TPM_TIS_CAP_DATA_TRANSFER_64B (3 << 9)
161 #define TPM_TIS_CAP_DATA_TRANSFER_LEGACY (0 << 9)
162 #define TPM_TIS_CAP_BURST_COUNT_DYNAMIC (0 << 8)
163 #define TPM_TIS_CAP_INTERRUPT_LOW_LEVEL (1 << 4) /* support is mandatory */
164 #define TPM_TIS_CAPABILITIES_SUPPORTED1_3 \
165 (TPM_TIS_CAP_INTERRUPT_LOW_LEVEL | \
166 TPM_TIS_CAP_BURST_COUNT_DYNAMIC | \
167 TPM_TIS_CAP_DATA_TRANSFER_64B | \
168 TPM_TIS_CAP_INTERFACE_VERSION1_3 | \
169 TPM_TIS_INTERRUPTS_SUPPORTED)
171 #define TPM_TIS_CAPABILITIES_SUPPORTED2_0 \
172 (TPM_TIS_CAP_INTERRUPT_LOW_LEVEL | \
173 TPM_TIS_CAP_BURST_COUNT_DYNAMIC | \
174 TPM_TIS_CAP_DATA_TRANSFER_64B | \
175 TPM_TIS_CAP_INTERFACE_VERSION1_3_FOR_TPM2_0 | \
176 TPM_TIS_INTERRUPTS_SUPPORTED)
178 #define TPM_TIS_IFACE_ID_INTERFACE_TIS1_3 (0xf) /* TPM 2.0 */
179 #define TPM_TIS_IFACE_ID_INTERFACE_FIFO (0x0) /* TPM 2.0 */
180 #define TPM_TIS_IFACE_ID_INTERFACE_VER_FIFO (0 << 4) /* TPM 2.0 */
181 #define TPM_TIS_IFACE_ID_CAP_5_LOCALITIES (1 << 8) /* TPM 2.0 */
182 #define TPM_TIS_IFACE_ID_CAP_TIS_SUPPORTED (1 << 13) /* TPM 2.0 */
183 #define TPM_TIS_IFACE_ID_INT_SEL_LOCK (1 << 19) /* TPM 2.0 */
185 #define TPM_TIS_IFACE_ID_SUPPORTED_FLAGS1_3 \
186 (TPM_TIS_IFACE_ID_INTERFACE_TIS1_3 | \
187 (~0u << 4)/* all of it is don't care */)
189 /* if backend was a TPM 2.0: */
190 #define TPM_TIS_IFACE_ID_SUPPORTED_FLAGS2_0 \
191 (TPM_TIS_IFACE_ID_INTERFACE_FIFO | \
192 TPM_TIS_IFACE_ID_INTERFACE_VER_FIFO | \
193 TPM_TIS_IFACE_ID_CAP_5_LOCALITIES | \
194 TPM_TIS_IFACE_ID_CAP_TIS_SUPPORTED)
196 #define TPM_TIS_TPM_DID 0x0001
197 #define TPM_TIS_TPM_VID PCI_VENDOR_ID_IBM
198 #define TPM_TIS_TPM_RID 0x0001
200 #define TPM_TIS_NO_DATA_BYTE 0xff
202 /* local prototypes */
204 static uint64_t tpm_tis_mmio_read(void *opaque
, hwaddr addr
,
207 /* utility functions */
209 static uint8_t tpm_tis_locality_from_addr(hwaddr addr
)
211 return (uint8_t)((addr
>> TPM_TIS_LOCALITY_SHIFT
) & 0x7);
214 static void tpm_tis_show_buffer(const unsigned char *buffer
,
215 size_t buffer_size
, const char *string
)
220 len
= MIN(tpm_cmd_get_size(buffer
), buffer_size
);
221 DPRINTF("tpm_tis: %s length = %d\n", string
, len
);
222 for (i
= 0; i
< len
; i
++) {
223 if (i
&& !(i
% 16)) {
226 DPRINTF("%.2X ", buffer
[i
]);
233 * Set the given flags in the STS register by clearing the register but
234 * preserving the SELFTEST_DONE and TPM_FAMILY_MASK flags and then setting
237 * The SELFTEST_DONE flag is acquired from the backend that determines it by
238 * peeking into TPM commands.
240 * A VM suspend/resume will preserve the flag by storing it into the VM
241 * device state, but the backend will not remember it when QEMU is started
242 * again. Therefore, we cache the flag here. Once set, it will not be unset
245 static void tpm_tis_sts_set(TPMLocality
*l
, uint32_t flags
)
247 l
->sts
&= TPM_TIS_STS_SELFTEST_DONE
| TPM_TIS_STS_TPM_FAMILY_MASK
;
252 * Send a request to the TPM.
254 static void tpm_tis_tpm_send(TPMState
*s
, uint8_t locty
)
256 tpm_tis_show_buffer(s
->buffer
, s
->be_buffer_size
,
260 * w_offset serves as length indicator for length of data;
261 * it's reset when the response comes back
263 s
->loc
[locty
].state
= TPM_TIS_STATE_EXECUTION
;
265 s
->cmd
= (TPMBackendCmd
) {
268 .in_len
= s
->w_offset
,
270 .out_len
= s
->be_buffer_size
,
273 tpm_backend_deliver_request(s
->be_driver
, &s
->cmd
);
276 /* raise an interrupt if allowed */
277 static void tpm_tis_raise_irq(TPMState
*s
, uint8_t locty
, uint32_t irqmask
)
279 if (!TPM_TIS_IS_VALID_LOCTY(locty
)) {
283 if ((s
->loc
[locty
].inte
& TPM_TIS_INT_ENABLED
) &&
284 (s
->loc
[locty
].inte
& irqmask
)) {
285 DPRINTF("tpm_tis: Raising IRQ for flag %08x\n", irqmask
);
286 qemu_irq_raise(s
->irq
);
287 s
->loc
[locty
].ints
|= irqmask
;
291 static uint32_t tpm_tis_check_request_use_except(TPMState
*s
, uint8_t locty
)
295 for (l
= 0; l
< TPM_TIS_NUM_LOCALITIES
; l
++) {
299 if ((s
->loc
[l
].access
& TPM_TIS_ACCESS_REQUEST_USE
)) {
307 static void tpm_tis_new_active_locality(TPMState
*s
, uint8_t new_active_locty
)
309 bool change
= (s
->active_locty
!= new_active_locty
);
313 if (change
&& TPM_TIS_IS_VALID_LOCTY(s
->active_locty
)) {
314 is_seize
= TPM_TIS_IS_VALID_LOCTY(new_active_locty
) &&
315 s
->loc
[new_active_locty
].access
& TPM_TIS_ACCESS_SEIZE
;
318 mask
= ~(TPM_TIS_ACCESS_ACTIVE_LOCALITY
);
320 mask
= ~(TPM_TIS_ACCESS_ACTIVE_LOCALITY
|
321 TPM_TIS_ACCESS_REQUEST_USE
);
323 /* reset flags on the old active locality */
324 s
->loc
[s
->active_locty
].access
&= mask
;
327 s
->loc
[s
->active_locty
].access
|= TPM_TIS_ACCESS_BEEN_SEIZED
;
331 s
->active_locty
= new_active_locty
;
333 DPRINTF("tpm_tis: Active locality is now %d\n", s
->active_locty
);
335 if (TPM_TIS_IS_VALID_LOCTY(new_active_locty
)) {
336 /* set flags on the new active locality */
337 s
->loc
[new_active_locty
].access
|= TPM_TIS_ACCESS_ACTIVE_LOCALITY
;
338 s
->loc
[new_active_locty
].access
&= ~(TPM_TIS_ACCESS_REQUEST_USE
|
339 TPM_TIS_ACCESS_SEIZE
);
343 tpm_tis_raise_irq(s
, s
->active_locty
, TPM_TIS_INT_LOCALITY_CHANGED
);
347 /* abort -- this function switches the locality */
348 static void tpm_tis_abort(TPMState
*s
, uint8_t locty
)
353 DPRINTF("tpm_tis: tis_abort: new active locality is %d\n", s
->next_locty
);
356 * Need to react differently depending on who's aborting now and
357 * which locality will become active afterwards.
359 if (s
->aborting_locty
== s
->next_locty
) {
360 s
->loc
[s
->aborting_locty
].state
= TPM_TIS_STATE_READY
;
361 tpm_tis_sts_set(&s
->loc
[s
->aborting_locty
],
362 TPM_TIS_STS_COMMAND_READY
);
363 tpm_tis_raise_irq(s
, s
->aborting_locty
, TPM_TIS_INT_COMMAND_READY
);
366 /* locality after abort is another one than the current one */
367 tpm_tis_new_active_locality(s
, s
->next_locty
);
369 s
->next_locty
= TPM_TIS_NO_LOCALITY
;
370 /* nobody's aborting a command anymore */
371 s
->aborting_locty
= TPM_TIS_NO_LOCALITY
;
374 /* prepare aborting current command */
375 static void tpm_tis_prep_abort(TPMState
*s
, uint8_t locty
, uint8_t newlocty
)
379 s
->aborting_locty
= locty
;
380 s
->next_locty
= newlocty
; /* locality after successful abort */
383 * only abort a command using an interrupt if currently executing
384 * a command AND if there's a valid connection to the vTPM.
386 for (busy_locty
= 0; busy_locty
< TPM_TIS_NUM_LOCALITIES
; busy_locty
++) {
387 if (s
->loc
[busy_locty
].state
== TPM_TIS_STATE_EXECUTION
) {
389 * request the backend to cancel. Some backends may not
392 tpm_backend_cancel_cmd(s
->be_driver
);
397 tpm_tis_abort(s
, locty
);
401 * Callback from the TPM to indicate that the response was received.
403 static void tpm_tis_request_completed(TPMIf
*ti
)
405 TPMState
*s
= TPM(ti
);
406 uint8_t locty
= s
->cmd
.locty
;
409 if (s
->cmd
.selftest_done
) {
410 for (l
= 0; l
< TPM_TIS_NUM_LOCALITIES
; l
++) {
411 s
->loc
[locty
].sts
|= TPM_TIS_STS_SELFTEST_DONE
;
415 tpm_tis_sts_set(&s
->loc
[locty
],
416 TPM_TIS_STS_VALID
| TPM_TIS_STS_DATA_AVAILABLE
);
417 s
->loc
[locty
].state
= TPM_TIS_STATE_COMPLETION
;
421 tpm_tis_show_buffer(s
->buffer
, s
->be_buffer_size
,
422 "tpm_tis: From TPM");
424 if (TPM_TIS_IS_VALID_LOCTY(s
->next_locty
)) {
425 tpm_tis_abort(s
, locty
);
428 tpm_tis_raise_irq(s
, locty
,
429 TPM_TIS_INT_DATA_AVAILABLE
| TPM_TIS_INT_STS_VALID
);
433 * Read a byte of response data
435 static uint32_t tpm_tis_data_read(TPMState
*s
, uint8_t locty
)
437 uint32_t ret
= TPM_TIS_NO_DATA_BYTE
;
440 if ((s
->loc
[locty
].sts
& TPM_TIS_STS_DATA_AVAILABLE
)) {
441 len
= MIN(tpm_cmd_get_size(&s
->buffer
),
444 ret
= s
->buffer
[s
->r_offset
++];
445 if (s
->r_offset
>= len
) {
447 tpm_tis_sts_set(&s
->loc
[locty
], TPM_TIS_STS_VALID
);
448 tpm_tis_raise_irq(s
, locty
, TPM_TIS_INT_STS_VALID
);
450 DPRINTF("tpm_tis: tpm_tis_data_read byte 0x%02x [%d]\n",
451 ret
, s
->r_offset
- 1);
458 static void tpm_tis_dump_state(void *opaque
, hwaddr addr
)
460 static const unsigned regs
[] = {
462 TPM_TIS_REG_INT_ENABLE
,
463 TPM_TIS_REG_INT_VECTOR
,
464 TPM_TIS_REG_INT_STATUS
,
465 TPM_TIS_REG_INTF_CAPABILITY
,
471 uint8_t locty
= tpm_tis_locality_from_addr(addr
);
472 hwaddr base
= addr
& ~0xfff;
473 TPMState
*s
= opaque
;
475 DPRINTF("tpm_tis: active locality : %d\n"
476 "tpm_tis: state of locality %d : %d\n"
477 "tpm_tis: register dump:\n",
479 locty
, s
->loc
[locty
].state
);
481 for (idx
= 0; regs
[idx
] != 0xfff; idx
++) {
482 DPRINTF("tpm_tis: 0x%04x : 0x%08x\n", regs
[idx
],
483 (int)tpm_tis_mmio_read(opaque
, base
+ regs
[idx
], 4));
486 DPRINTF("tpm_tis: read offset : %d\n"
487 "tpm_tis: result buffer : ",
490 idx
< MIN(tpm_cmd_get_size(&s
->buffer
), s
->be_buffer_size
);
493 s
->r_offset
== idx
? '>' : ' ',
495 ((idx
& 0xf) == 0xf) ? "\ntpm_tis: " : "");
498 "tpm_tis: write offset : %d\n"
499 "tpm_tis: request buffer: ",
502 idx
< MIN(tpm_cmd_get_size(s
->buffer
), s
->be_buffer_size
);
505 s
->w_offset
== idx
? '>' : ' ',
507 ((idx
& 0xf) == 0xf) ? "\ntpm_tis: " : "");
514 * Read a register of the TIS interface
515 * See specs pages 33-63 for description of the registers
517 static uint64_t tpm_tis_mmio_read(void *opaque
, hwaddr addr
,
520 TPMState
*s
= opaque
;
521 uint16_t offset
= addr
& 0xffc;
522 uint8_t shift
= (addr
& 0x3) * 8;
523 uint32_t val
= 0xffffffff;
524 uint8_t locty
= tpm_tis_locality_from_addr(addr
);
528 if (tpm_backend_had_startup_error(s
->be_driver
)) {
533 case TPM_TIS_REG_ACCESS
:
534 /* never show the SEIZE flag even though we use it internally */
535 val
= s
->loc
[locty
].access
& ~TPM_TIS_ACCESS_SEIZE
;
536 /* the pending flag is always calculated */
537 if (tpm_tis_check_request_use_except(s
, locty
)) {
538 val
|= TPM_TIS_ACCESS_PENDING_REQUEST
;
540 val
|= !tpm_backend_get_tpm_established_flag(s
->be_driver
);
542 case TPM_TIS_REG_INT_ENABLE
:
543 val
= s
->loc
[locty
].inte
;
545 case TPM_TIS_REG_INT_VECTOR
:
548 case TPM_TIS_REG_INT_STATUS
:
549 val
= s
->loc
[locty
].ints
;
551 case TPM_TIS_REG_INTF_CAPABILITY
:
552 switch (s
->be_tpm_version
) {
553 case TPM_VERSION_UNSPEC
:
556 case TPM_VERSION_1_2
:
557 val
= TPM_TIS_CAPABILITIES_SUPPORTED1_3
;
559 case TPM_VERSION_2_0
:
560 val
= TPM_TIS_CAPABILITIES_SUPPORTED2_0
;
564 case TPM_TIS_REG_STS
:
565 if (s
->active_locty
== locty
) {
566 if ((s
->loc
[locty
].sts
& TPM_TIS_STS_DATA_AVAILABLE
)) {
567 val
= TPM_TIS_BURST_COUNT(
568 MIN(tpm_cmd_get_size(&s
->buffer
),
570 - s
->r_offset
) | s
->loc
[locty
].sts
;
572 avail
= s
->be_buffer_size
- s
->w_offset
;
574 * byte-sized reads should not return 0x00 for 0x100
577 if (size
== 1 && avail
> 0xff) {
580 val
= TPM_TIS_BURST_COUNT(avail
) | s
->loc
[locty
].sts
;
584 case TPM_TIS_REG_DATA_FIFO
:
585 case TPM_TIS_REG_DATA_XFIFO
... TPM_TIS_REG_DATA_XFIFO_END
:
586 if (s
->active_locty
== locty
) {
587 if (size
> 4 - (addr
& 0x3)) {
588 /* prevent access beyond FIFO */
589 size
= 4 - (addr
& 0x3);
594 switch (s
->loc
[locty
].state
) {
595 case TPM_TIS_STATE_COMPLETION
:
596 v
= tpm_tis_data_read(s
, locty
);
599 v
= TPM_TIS_NO_DATA_BYTE
;
606 shift
= 0; /* no more adjustments */
609 case TPM_TIS_REG_INTERFACE_ID
:
610 val
= s
->loc
[locty
].iface_id
;
612 case TPM_TIS_REG_DID_VID
:
613 val
= (TPM_TIS_TPM_DID
<< 16) | TPM_TIS_TPM_VID
;
615 case TPM_TIS_REG_RID
:
616 val
= TPM_TIS_TPM_RID
;
619 case TPM_TIS_REG_DEBUG
:
620 tpm_tis_dump_state(opaque
, addr
);
629 DPRINTF("tpm_tis: read.%u(%08x) = %08x\n", size
, (int)addr
, (int)val
);
635 * Write a value to a register of the TIS interface
636 * See specs pages 33-63 for description of the registers
638 static void tpm_tis_mmio_write(void *opaque
, hwaddr addr
,
639 uint64_t val
, unsigned size
)
641 TPMState
*s
= opaque
;
642 uint16_t off
= addr
& 0xffc;
643 uint8_t shift
= (addr
& 0x3) * 8;
644 uint8_t locty
= tpm_tis_locality_from_addr(addr
);
645 uint8_t active_locty
, l
;
646 int c
, set_new_locty
= 1;
648 uint32_t mask
= (size
== 1) ? 0xff : ((size
== 2) ? 0xffff : ~0);
650 DPRINTF("tpm_tis: write.%u(%08x) = %08x\n", size
, (int)addr
, (int)val
);
653 DPRINTF("tpm_tis: Access to locality 4 only allowed from hardware\n");
657 if (tpm_backend_had_startup_error(s
->be_driver
)) {
671 case TPM_TIS_REG_ACCESS
:
673 if ((val
& TPM_TIS_ACCESS_SEIZE
)) {
674 val
&= ~(TPM_TIS_ACCESS_REQUEST_USE
|
675 TPM_TIS_ACCESS_ACTIVE_LOCALITY
);
678 active_locty
= s
->active_locty
;
680 if ((val
& TPM_TIS_ACCESS_ACTIVE_LOCALITY
)) {
681 /* give up locality if currently owned */
682 if (s
->active_locty
== locty
) {
683 DPRINTF("tpm_tis: Releasing locality %d\n", locty
);
685 uint8_t newlocty
= TPM_TIS_NO_LOCALITY
;
686 /* anybody wants the locality ? */
687 for (c
= TPM_TIS_NUM_LOCALITIES
- 1; c
>= 0; c
--) {
688 if ((s
->loc
[c
].access
& TPM_TIS_ACCESS_REQUEST_USE
)) {
689 DPRINTF("tpm_tis: Locality %d requests use.\n", c
);
694 DPRINTF("tpm_tis: TPM_TIS_ACCESS_ACTIVE_LOCALITY: "
695 "Next active locality: %d\n",
698 if (TPM_TIS_IS_VALID_LOCTY(newlocty
)) {
700 tpm_tis_prep_abort(s
, locty
, newlocty
);
702 active_locty
= TPM_TIS_NO_LOCALITY
;
705 /* not currently the owner; clear a pending request */
706 s
->loc
[locty
].access
&= ~TPM_TIS_ACCESS_REQUEST_USE
;
710 if ((val
& TPM_TIS_ACCESS_BEEN_SEIZED
)) {
711 s
->loc
[locty
].access
&= ~TPM_TIS_ACCESS_BEEN_SEIZED
;
714 if ((val
& TPM_TIS_ACCESS_SEIZE
)) {
716 * allow seize if a locality is active and the requesting
717 * locality is higher than the one that's active
719 * allow seize for requesting locality if no locality is
722 while ((TPM_TIS_IS_VALID_LOCTY(s
->active_locty
) &&
723 locty
> s
->active_locty
) ||
724 !TPM_TIS_IS_VALID_LOCTY(s
->active_locty
)) {
725 bool higher_seize
= FALSE
;
727 /* already a pending SEIZE ? */
728 if ((s
->loc
[locty
].access
& TPM_TIS_ACCESS_SEIZE
)) {
732 /* check for ongoing seize by a higher locality */
733 for (l
= locty
+ 1; l
< TPM_TIS_NUM_LOCALITIES
; l
++) {
734 if ((s
->loc
[l
].access
& TPM_TIS_ACCESS_SEIZE
)) {
744 /* cancel any seize by a lower locality */
745 for (l
= 0; l
< locty
- 1; l
++) {
746 s
->loc
[l
].access
&= ~TPM_TIS_ACCESS_SEIZE
;
749 s
->loc
[locty
].access
|= TPM_TIS_ACCESS_SEIZE
;
750 DPRINTF("tpm_tis: TPM_TIS_ACCESS_SEIZE: "
751 "Locality %d seized from locality %d\n",
752 locty
, s
->active_locty
);
753 DPRINTF("tpm_tis: TPM_TIS_ACCESS_SEIZE: Initiating abort.\n");
755 tpm_tis_prep_abort(s
, s
->active_locty
, locty
);
760 if ((val
& TPM_TIS_ACCESS_REQUEST_USE
)) {
761 if (s
->active_locty
!= locty
) {
762 if (TPM_TIS_IS_VALID_LOCTY(s
->active_locty
)) {
763 s
->loc
[locty
].access
|= TPM_TIS_ACCESS_REQUEST_USE
;
765 /* no locality active -> make this one active now */
766 active_locty
= locty
;
772 tpm_tis_new_active_locality(s
, active_locty
);
776 case TPM_TIS_REG_INT_ENABLE
:
777 if (s
->active_locty
!= locty
) {
781 s
->loc
[locty
].inte
&= mask
;
782 s
->loc
[locty
].inte
|= (val
& (TPM_TIS_INT_ENABLED
|
783 TPM_TIS_INT_POLARITY_MASK
|
784 TPM_TIS_INTERRUPTS_SUPPORTED
));
786 case TPM_TIS_REG_INT_VECTOR
:
787 /* hard wired -- ignore */
789 case TPM_TIS_REG_INT_STATUS
:
790 if (s
->active_locty
!= locty
) {
794 /* clearing of interrupt flags */
795 if (((val
& TPM_TIS_INTERRUPTS_SUPPORTED
)) &&
796 (s
->loc
[locty
].ints
& TPM_TIS_INTERRUPTS_SUPPORTED
)) {
797 s
->loc
[locty
].ints
&= ~val
;
798 if (s
->loc
[locty
].ints
== 0) {
799 qemu_irq_lower(s
->irq
);
800 DPRINTF("tpm_tis: Lowering IRQ\n");
803 s
->loc
[locty
].ints
&= ~(val
& TPM_TIS_INTERRUPTS_SUPPORTED
);
805 case TPM_TIS_REG_STS
:
806 if (s
->active_locty
!= locty
) {
810 if (s
->be_tpm_version
== TPM_VERSION_2_0
) {
811 /* some flags that are only supported for TPM 2 */
812 if (val
& TPM_TIS_STS_COMMAND_CANCEL
) {
813 if (s
->loc
[locty
].state
== TPM_TIS_STATE_EXECUTION
) {
815 * request the backend to cancel. Some backends may not
818 tpm_backend_cancel_cmd(s
->be_driver
);
822 if (val
& TPM_TIS_STS_RESET_ESTABLISHMENT_BIT
) {
823 if (locty
== 3 || locty
== 4) {
824 tpm_backend_reset_tpm_established_flag(s
->be_driver
, locty
);
829 val
&= (TPM_TIS_STS_COMMAND_READY
| TPM_TIS_STS_TPM_GO
|
830 TPM_TIS_STS_RESPONSE_RETRY
);
832 if (val
== TPM_TIS_STS_COMMAND_READY
) {
833 switch (s
->loc
[locty
].state
) {
835 case TPM_TIS_STATE_READY
:
840 case TPM_TIS_STATE_IDLE
:
841 tpm_tis_sts_set(&s
->loc
[locty
], TPM_TIS_STS_COMMAND_READY
);
842 s
->loc
[locty
].state
= TPM_TIS_STATE_READY
;
843 tpm_tis_raise_irq(s
, locty
, TPM_TIS_INT_COMMAND_READY
);
846 case TPM_TIS_STATE_EXECUTION
:
847 case TPM_TIS_STATE_RECEPTION
:
848 /* abort currently running command */
849 DPRINTF("tpm_tis: %s: Initiating abort.\n",
851 tpm_tis_prep_abort(s
, locty
, locty
);
854 case TPM_TIS_STATE_COMPLETION
:
857 /* shortcut to ready state with C/R set */
858 s
->loc
[locty
].state
= TPM_TIS_STATE_READY
;
859 if (!(s
->loc
[locty
].sts
& TPM_TIS_STS_COMMAND_READY
)) {
860 tpm_tis_sts_set(&s
->loc
[locty
],
861 TPM_TIS_STS_COMMAND_READY
);
862 tpm_tis_raise_irq(s
, locty
, TPM_TIS_INT_COMMAND_READY
);
864 s
->loc
[locty
].sts
&= ~(TPM_TIS_STS_DATA_AVAILABLE
);
868 } else if (val
== TPM_TIS_STS_TPM_GO
) {
869 switch (s
->loc
[locty
].state
) {
870 case TPM_TIS_STATE_RECEPTION
:
871 if ((s
->loc
[locty
].sts
& TPM_TIS_STS_EXPECT
) == 0) {
872 tpm_tis_tpm_send(s
, locty
);
879 } else if (val
== TPM_TIS_STS_RESPONSE_RETRY
) {
880 switch (s
->loc
[locty
].state
) {
881 case TPM_TIS_STATE_COMPLETION
:
883 tpm_tis_sts_set(&s
->loc
[locty
],
885 TPM_TIS_STS_DATA_AVAILABLE
);
893 case TPM_TIS_REG_DATA_FIFO
:
894 case TPM_TIS_REG_DATA_XFIFO
... TPM_TIS_REG_DATA_XFIFO_END
:
896 if (s
->active_locty
!= locty
) {
900 if (s
->loc
[locty
].state
== TPM_TIS_STATE_IDLE
||
901 s
->loc
[locty
].state
== TPM_TIS_STATE_EXECUTION
||
902 s
->loc
[locty
].state
== TPM_TIS_STATE_COMPLETION
) {
905 DPRINTF("tpm_tis: Data to send to TPM: %08x (size=%d)\n",
907 if (s
->loc
[locty
].state
== TPM_TIS_STATE_READY
) {
908 s
->loc
[locty
].state
= TPM_TIS_STATE_RECEPTION
;
909 tpm_tis_sts_set(&s
->loc
[locty
],
910 TPM_TIS_STS_EXPECT
| TPM_TIS_STS_VALID
);
914 if (size
> 4 - (addr
& 0x3)) {
915 /* prevent access beyond FIFO */
916 size
= 4 - (addr
& 0x3);
919 while ((s
->loc
[locty
].sts
& TPM_TIS_STS_EXPECT
) && size
> 0) {
920 if (s
->w_offset
< s
->be_buffer_size
) {
921 s
->buffer
[s
->w_offset
++] =
926 tpm_tis_sts_set(&s
->loc
[locty
], TPM_TIS_STS_VALID
);
930 /* check for complete packet */
931 if (s
->w_offset
> 5 &&
932 (s
->loc
[locty
].sts
& TPM_TIS_STS_EXPECT
)) {
933 /* we have a packet length - see if we have all of it */
934 bool need_irq
= !(s
->loc
[locty
].sts
& TPM_TIS_STS_VALID
);
936 len
= tpm_cmd_get_size(&s
->buffer
);
937 if (len
> s
->w_offset
) {
938 tpm_tis_sts_set(&s
->loc
[locty
],
939 TPM_TIS_STS_EXPECT
| TPM_TIS_STS_VALID
);
941 /* packet complete */
942 tpm_tis_sts_set(&s
->loc
[locty
], TPM_TIS_STS_VALID
);
945 tpm_tis_raise_irq(s
, locty
, TPM_TIS_INT_STS_VALID
);
950 case TPM_TIS_REG_INTERFACE_ID
:
951 if (val
& TPM_TIS_IFACE_ID_INT_SEL_LOCK
) {
952 for (l
= 0; l
< TPM_TIS_NUM_LOCALITIES
; l
++) {
953 s
->loc
[l
].iface_id
|= TPM_TIS_IFACE_ID_INT_SEL_LOCK
;
960 static const MemoryRegionOps tpm_tis_memory_ops
= {
961 .read
= tpm_tis_mmio_read
,
962 .write
= tpm_tis_mmio_write
,
963 .endianness
= DEVICE_LITTLE_ENDIAN
,
965 .min_access_size
= 1,
966 .max_access_size
= 4,
970 static int tpm_tis_do_startup_tpm(TPMState
*s
, size_t buffersize
)
972 return tpm_backend_startup_tpm(s
->be_driver
, buffersize
);
976 * Get the TPMVersion of the backend device being used
978 static enum TPMVersion
tpm_tis_get_tpm_version(TPMIf
*ti
)
980 TPMState
*s
= TPM(ti
);
982 if (tpm_backend_had_startup_error(s
->be_driver
)) {
983 return TPM_VERSION_UNSPEC
;
986 return tpm_backend_get_tpm_version(s
->be_driver
);
990 * This function is called when the machine starts, resets or due to
993 static void tpm_tis_reset(DeviceState
*dev
)
995 TPMState
*s
= TPM(dev
);
998 s
->be_tpm_version
= tpm_backend_get_tpm_version(s
->be_driver
);
999 s
->be_buffer_size
= MIN(tpm_backend_get_buffer_size(s
->be_driver
),
1000 TPM_TIS_BUFFER_MAX
);
1002 tpm_backend_reset(s
->be_driver
);
1004 s
->active_locty
= TPM_TIS_NO_LOCALITY
;
1005 s
->next_locty
= TPM_TIS_NO_LOCALITY
;
1006 s
->aborting_locty
= TPM_TIS_NO_LOCALITY
;
1008 for (c
= 0; c
< TPM_TIS_NUM_LOCALITIES
; c
++) {
1009 s
->loc
[c
].access
= TPM_TIS_ACCESS_TPM_REG_VALID_STS
;
1010 switch (s
->be_tpm_version
) {
1011 case TPM_VERSION_UNSPEC
:
1013 case TPM_VERSION_1_2
:
1014 s
->loc
[c
].sts
= TPM_TIS_STS_TPM_FAMILY1_2
;
1015 s
->loc
[c
].iface_id
= TPM_TIS_IFACE_ID_SUPPORTED_FLAGS1_3
;
1017 case TPM_VERSION_2_0
:
1018 s
->loc
[c
].sts
= TPM_TIS_STS_TPM_FAMILY2_0
;
1019 s
->loc
[c
].iface_id
= TPM_TIS_IFACE_ID_SUPPORTED_FLAGS2_0
;
1022 s
->loc
[c
].inte
= TPM_TIS_INT_POLARITY_LOW_LEVEL
;
1024 s
->loc
[c
].state
= TPM_TIS_STATE_IDLE
;
1030 tpm_tis_do_startup_tpm(s
, s
->be_buffer_size
);
1033 static const VMStateDescription vmstate_tpm_tis
= {
1038 static Property tpm_tis_properties
[] = {
1039 DEFINE_PROP_UINT32("irq", TPMState
, irq_num
, TPM_TIS_IRQ
),
1040 DEFINE_PROP_TPMBE("tpmdev", TPMState
, be_driver
),
1041 DEFINE_PROP_END_OF_LIST(),
1044 static void tpm_tis_realizefn(DeviceState
*dev
, Error
**errp
)
1046 TPMState
*s
= TPM(dev
);
1049 error_setg(errp
, "at most one TPM device is permitted");
1053 if (!s
->be_driver
) {
1054 error_setg(errp
, "'tpmdev' property is required");
1057 if (s
->irq_num
> 15) {
1058 error_setg(errp
, "IRQ %d is outside valid range of 0 to 15",
1063 isa_init_irq(&s
->busdev
, &s
->irq
, s
->irq_num
);
1065 memory_region_add_subregion(isa_address_space(ISA_DEVICE(dev
)),
1066 TPM_TIS_ADDR_BASE
, &s
->mmio
);
1069 static void tpm_tis_initfn(Object
*obj
)
1071 TPMState
*s
= TPM(obj
);
1073 memory_region_init_io(&s
->mmio
, OBJECT(s
), &tpm_tis_memory_ops
,
1075 TPM_TIS_NUM_LOCALITIES
<< TPM_TIS_LOCALITY_SHIFT
);
1078 static void tpm_tis_class_init(ObjectClass
*klass
, void *data
)
1080 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1081 TPMIfClass
*tc
= TPM_IF_CLASS(klass
);
1083 dc
->realize
= tpm_tis_realizefn
;
1084 dc
->props
= tpm_tis_properties
;
1085 dc
->reset
= tpm_tis_reset
;
1086 dc
->vmsd
= &vmstate_tpm_tis
;
1087 tc
->model
= TPM_MODEL_TPM_TIS
;
1088 tc
->get_version
= tpm_tis_get_tpm_version
;
1089 tc
->request_completed
= tpm_tis_request_completed
;
1092 static const TypeInfo tpm_tis_info
= {
1093 .name
= TYPE_TPM_TIS
,
1094 .parent
= TYPE_ISA_DEVICE
,
1095 .instance_size
= sizeof(TPMState
),
1096 .instance_init
= tpm_tis_initfn
,
1097 .class_init
= tpm_tis_class_init
,
1098 .interfaces
= (InterfaceInfo
[]) {
1104 static void tpm_tis_register(void)
1106 type_register_static(&tpm_tis_info
);
1109 type_init(tpm_tis_register
)