1 | /* |
2 | * tpm_tis.c - QEMU's TPM TIS interface emulator |
3 | * |
4 | * Copyright (C) 2006,2010-2013 IBM Corporation |
5 | * |
6 | * Authors: |
7 | * Stefan Berger <stefanb@us.ibm.com> |
8 | * David Safford <safford@us.ibm.com> |
9 | * |
10 | * Xen 4 support: Andrease Niederl <andreas.niederl@iaik.tugraz.at> |
11 | * |
12 | * This work is licensed under the terms of the GNU GPL, version 2 or later. |
13 | * See the COPYING file in the top-level directory. |
14 | * |
15 | * Implementation of the TIS interface according to specs found at |
16 | * http://www.trustedcomputinggroup.org. This implementation currently |
17 | * supports version 1.3, 21 March 2013 |
18 | * In the developers menu choose the PC Client section then find the TIS |
19 | * specification. |
20 | * |
21 | * TPM TIS for TPM 2 implementation following TCG PC Client Platform |
22 | * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43 |
23 | */ |
24 | |
25 | #include "qemu/osdep.h" |
26 | #include "hw/irq.h" |
27 | #include "hw/isa/isa.h" |
28 | #include "qapi/error.h" |
29 | #include "qemu/module.h" |
30 | |
31 | #include "hw/acpi/tpm.h" |
32 | #include "hw/pci/pci_ids.h" |
33 | #include "hw/qdev-properties.h" |
34 | #include "migration/vmstate.h" |
35 | #include "sysemu/tpm_backend.h" |
36 | #include "tpm_int.h" |
37 | #include "tpm_util.h" |
38 | #include "tpm_ppi.h" |
39 | #include "trace.h" |
40 | |
41 | #define TPM_TIS_NUM_LOCALITIES 5 /* per spec */ |
42 | #define TPM_TIS_LOCALITY_SHIFT 12 |
43 | #define TPM_TIS_NO_LOCALITY 0xff |
44 | |
45 | #define TPM_TIS_IS_VALID_LOCTY(x) ((x) < TPM_TIS_NUM_LOCALITIES) |
46 | |
47 | #define TPM_TIS_BUFFER_MAX 4096 |
48 | |
49 | typedef enum { |
50 | TPM_TIS_STATE_IDLE = 0, |
51 | TPM_TIS_STATE_READY, |
52 | TPM_TIS_STATE_COMPLETION, |
53 | TPM_TIS_STATE_EXECUTION, |
54 | TPM_TIS_STATE_RECEPTION, |
55 | } TPMTISState; |
56 | |
57 | /* locality data -- all fields are persisted */ |
58 | typedef struct TPMLocality { |
59 | TPMTISState state; |
60 | uint8_t access; |
61 | uint32_t sts; |
62 | uint32_t iface_id; |
63 | uint32_t inte; |
64 | uint32_t ints; |
65 | } TPMLocality; |
66 | |
67 | typedef struct TPMState { |
68 | ISADevice busdev; |
69 | MemoryRegion mmio; |
70 | |
71 | unsigned char buffer[TPM_TIS_BUFFER_MAX]; |
72 | uint16_t rw_offset; |
73 | |
74 | uint8_t active_locty; |
75 | uint8_t aborting_locty; |
76 | uint8_t next_locty; |
77 | |
78 | TPMLocality loc[TPM_TIS_NUM_LOCALITIES]; |
79 | |
80 | qemu_irq irq; |
81 | uint32_t irq_num; |
82 | |
83 | TPMBackendCmd cmd; |
84 | |
85 | TPMBackend *be_driver; |
86 | TPMVersion be_tpm_version; |
87 | |
88 | size_t be_buffer_size; |
89 | |
90 | bool ppi_enabled; |
91 | TPMPPI ppi; |
92 | } TPMState; |
93 | |
94 | #define TPM(obj) OBJECT_CHECK(TPMState, (obj), TYPE_TPM_TIS) |
95 | |
96 | #define DEBUG_TIS 0 |
97 | |
98 | /* local prototypes */ |
99 | |
100 | static uint64_t tpm_tis_mmio_read(void *opaque, hwaddr addr, |
101 | unsigned size); |
102 | |
103 | /* utility functions */ |
104 | |
105 | static uint8_t tpm_tis_locality_from_addr(hwaddr addr) |
106 | { |
107 | return (uint8_t)((addr >> TPM_TIS_LOCALITY_SHIFT) & 0x7); |
108 | } |
109 | |
110 | static void tpm_tis_show_buffer(const unsigned char *buffer, |
111 | size_t buffer_size, const char *string) |
112 | { |
113 | size_t len, i; |
114 | char *line_buffer, *p; |
115 | |
116 | len = MIN(tpm_cmd_get_size(buffer), buffer_size); |
117 | |
118 | /* |
119 | * allocate enough room for 3 chars per buffer entry plus a |
120 | * newline after every 16 chars and a final null terminator. |
121 | */ |
122 | line_buffer = g_malloc(len * 3 + (len / 16) + 1); |
123 | |
124 | for (i = 0, p = line_buffer; i < len; i++) { |
125 | if (i && !(i % 16)) { |
126 | p += sprintf(p, "\n" ); |
127 | } |
128 | p += sprintf(p, "%.2X " , buffer[i]); |
129 | } |
130 | trace_tpm_tis_show_buffer(string, len, line_buffer); |
131 | |
132 | g_free(line_buffer); |
133 | } |
134 | |
135 | /* |
136 | * Set the given flags in the STS register by clearing the register but |
137 | * preserving the SELFTEST_DONE and TPM_FAMILY_MASK flags and then setting |
138 | * the new flags. |
139 | * |
140 | * The SELFTEST_DONE flag is acquired from the backend that determines it by |
141 | * peeking into TPM commands. |
142 | * |
143 | * A VM suspend/resume will preserve the flag by storing it into the VM |
144 | * device state, but the backend will not remember it when QEMU is started |
145 | * again. Therefore, we cache the flag here. Once set, it will not be unset |
146 | * except by a reset. |
147 | */ |
148 | static void tpm_tis_sts_set(TPMLocality *l, uint32_t flags) |
149 | { |
150 | l->sts &= TPM_TIS_STS_SELFTEST_DONE | TPM_TIS_STS_TPM_FAMILY_MASK; |
151 | l->sts |= flags; |
152 | } |
153 | |
154 | /* |
155 | * Send a request to the TPM. |
156 | */ |
157 | static void tpm_tis_tpm_send(TPMState *s, uint8_t locty) |
158 | { |
159 | if (trace_event_get_state_backends(TRACE_TPM_TIS_SHOW_BUFFER)) { |
160 | tpm_tis_show_buffer(s->buffer, s->be_buffer_size, "To TPM" ); |
161 | } |
162 | |
163 | /* |
164 | * rw_offset serves as length indicator for length of data; |
165 | * it's reset when the response comes back |
166 | */ |
167 | s->loc[locty].state = TPM_TIS_STATE_EXECUTION; |
168 | |
169 | s->cmd = (TPMBackendCmd) { |
170 | .locty = locty, |
171 | .in = s->buffer, |
172 | .in_len = s->rw_offset, |
173 | .out = s->buffer, |
174 | .out_len = s->be_buffer_size, |
175 | }; |
176 | |
177 | tpm_backend_deliver_request(s->be_driver, &s->cmd); |
178 | } |
179 | |
180 | /* raise an interrupt if allowed */ |
181 | static void tpm_tis_raise_irq(TPMState *s, uint8_t locty, uint32_t irqmask) |
182 | { |
183 | if (!TPM_TIS_IS_VALID_LOCTY(locty)) { |
184 | return; |
185 | } |
186 | |
187 | if ((s->loc[locty].inte & TPM_TIS_INT_ENABLED) && |
188 | (s->loc[locty].inte & irqmask)) { |
189 | trace_tpm_tis_raise_irq(irqmask); |
190 | qemu_irq_raise(s->irq); |
191 | s->loc[locty].ints |= irqmask; |
192 | } |
193 | } |
194 | |
195 | static uint32_t tpm_tis_check_request_use_except(TPMState *s, uint8_t locty) |
196 | { |
197 | uint8_t l; |
198 | |
199 | for (l = 0; l < TPM_TIS_NUM_LOCALITIES; l++) { |
200 | if (l == locty) { |
201 | continue; |
202 | } |
203 | if ((s->loc[l].access & TPM_TIS_ACCESS_REQUEST_USE)) { |
204 | return 1; |
205 | } |
206 | } |
207 | |
208 | return 0; |
209 | } |
210 | |
211 | static void tpm_tis_new_active_locality(TPMState *s, uint8_t new_active_locty) |
212 | { |
213 | bool change = (s->active_locty != new_active_locty); |
214 | bool is_seize; |
215 | uint8_t mask; |
216 | |
217 | if (change && TPM_TIS_IS_VALID_LOCTY(s->active_locty)) { |
218 | is_seize = TPM_TIS_IS_VALID_LOCTY(new_active_locty) && |
219 | s->loc[new_active_locty].access & TPM_TIS_ACCESS_SEIZE; |
220 | |
221 | if (is_seize) { |
222 | mask = ~(TPM_TIS_ACCESS_ACTIVE_LOCALITY); |
223 | } else { |
224 | mask = ~(TPM_TIS_ACCESS_ACTIVE_LOCALITY| |
225 | TPM_TIS_ACCESS_REQUEST_USE); |
226 | } |
227 | /* reset flags on the old active locality */ |
228 | s->loc[s->active_locty].access &= mask; |
229 | |
230 | if (is_seize) { |
231 | s->loc[s->active_locty].access |= TPM_TIS_ACCESS_BEEN_SEIZED; |
232 | } |
233 | } |
234 | |
235 | s->active_locty = new_active_locty; |
236 | |
237 | trace_tpm_tis_new_active_locality(s->active_locty); |
238 | |
239 | if (TPM_TIS_IS_VALID_LOCTY(new_active_locty)) { |
240 | /* set flags on the new active locality */ |
241 | s->loc[new_active_locty].access |= TPM_TIS_ACCESS_ACTIVE_LOCALITY; |
242 | s->loc[new_active_locty].access &= ~(TPM_TIS_ACCESS_REQUEST_USE | |
243 | TPM_TIS_ACCESS_SEIZE); |
244 | } |
245 | |
246 | if (change) { |
247 | tpm_tis_raise_irq(s, s->active_locty, TPM_TIS_INT_LOCALITY_CHANGED); |
248 | } |
249 | } |
250 | |
251 | /* abort -- this function switches the locality */ |
252 | static void tpm_tis_abort(TPMState *s) |
253 | { |
254 | s->rw_offset = 0; |
255 | |
256 | trace_tpm_tis_abort(s->next_locty); |
257 | |
258 | /* |
259 | * Need to react differently depending on who's aborting now and |
260 | * which locality will become active afterwards. |
261 | */ |
262 | if (s->aborting_locty == s->next_locty) { |
263 | s->loc[s->aborting_locty].state = TPM_TIS_STATE_READY; |
264 | tpm_tis_sts_set(&s->loc[s->aborting_locty], |
265 | TPM_TIS_STS_COMMAND_READY); |
266 | tpm_tis_raise_irq(s, s->aborting_locty, TPM_TIS_INT_COMMAND_READY); |
267 | } |
268 | |
269 | /* locality after abort is another one than the current one */ |
270 | tpm_tis_new_active_locality(s, s->next_locty); |
271 | |
272 | s->next_locty = TPM_TIS_NO_LOCALITY; |
273 | /* nobody's aborting a command anymore */ |
274 | s->aborting_locty = TPM_TIS_NO_LOCALITY; |
275 | } |
276 | |
277 | /* prepare aborting current command */ |
278 | static void tpm_tis_prep_abort(TPMState *s, uint8_t locty, uint8_t newlocty) |
279 | { |
280 | uint8_t busy_locty; |
281 | |
282 | assert(TPM_TIS_IS_VALID_LOCTY(newlocty)); |
283 | |
284 | s->aborting_locty = locty; /* may also be TPM_TIS_NO_LOCALITY */ |
285 | s->next_locty = newlocty; /* locality after successful abort */ |
286 | |
287 | /* |
288 | * only abort a command using an interrupt if currently executing |
289 | * a command AND if there's a valid connection to the vTPM. |
290 | */ |
291 | for (busy_locty = 0; busy_locty < TPM_TIS_NUM_LOCALITIES; busy_locty++) { |
292 | if (s->loc[busy_locty].state == TPM_TIS_STATE_EXECUTION) { |
293 | /* |
294 | * request the backend to cancel. Some backends may not |
295 | * support it |
296 | */ |
297 | tpm_backend_cancel_cmd(s->be_driver); |
298 | return; |
299 | } |
300 | } |
301 | |
302 | tpm_tis_abort(s); |
303 | } |
304 | |
305 | /* |
306 | * Callback from the TPM to indicate that the response was received. |
307 | */ |
308 | static void tpm_tis_request_completed(TPMIf *ti, int ret) |
309 | { |
310 | TPMState *s = TPM(ti); |
311 | uint8_t locty = s->cmd.locty; |
312 | uint8_t l; |
313 | |
314 | assert(TPM_TIS_IS_VALID_LOCTY(locty)); |
315 | |
316 | if (s->cmd.selftest_done) { |
317 | for (l = 0; l < TPM_TIS_NUM_LOCALITIES; l++) { |
318 | s->loc[l].sts |= TPM_TIS_STS_SELFTEST_DONE; |
319 | } |
320 | } |
321 | |
322 | /* FIXME: report error if ret != 0 */ |
323 | tpm_tis_sts_set(&s->loc[locty], |
324 | TPM_TIS_STS_VALID | TPM_TIS_STS_DATA_AVAILABLE); |
325 | s->loc[locty].state = TPM_TIS_STATE_COMPLETION; |
326 | s->rw_offset = 0; |
327 | |
328 | if (trace_event_get_state_backends(TRACE_TPM_TIS_SHOW_BUFFER)) { |
329 | tpm_tis_show_buffer(s->buffer, s->be_buffer_size, "From TPM" ); |
330 | } |
331 | |
332 | if (TPM_TIS_IS_VALID_LOCTY(s->next_locty)) { |
333 | tpm_tis_abort(s); |
334 | } |
335 | |
336 | tpm_tis_raise_irq(s, locty, |
337 | TPM_TIS_INT_DATA_AVAILABLE | TPM_TIS_INT_STS_VALID); |
338 | } |
339 | |
340 | /* |
341 | * Read a byte of response data |
342 | */ |
343 | static uint32_t tpm_tis_data_read(TPMState *s, uint8_t locty) |
344 | { |
345 | uint32_t ret = TPM_TIS_NO_DATA_BYTE; |
346 | uint16_t len; |
347 | |
348 | if ((s->loc[locty].sts & TPM_TIS_STS_DATA_AVAILABLE)) { |
349 | len = MIN(tpm_cmd_get_size(&s->buffer), |
350 | s->be_buffer_size); |
351 | |
352 | ret = s->buffer[s->rw_offset++]; |
353 | if (s->rw_offset >= len) { |
354 | /* got last byte */ |
355 | tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID); |
356 | tpm_tis_raise_irq(s, locty, TPM_TIS_INT_STS_VALID); |
357 | } |
358 | trace_tpm_tis_data_read(ret, s->rw_offset - 1); |
359 | } |
360 | |
361 | return ret; |
362 | } |
363 | |
364 | #ifdef DEBUG_TIS |
365 | static void tpm_tis_dump_state(void *opaque, hwaddr addr) |
366 | { |
367 | static const unsigned regs[] = { |
368 | TPM_TIS_REG_ACCESS, |
369 | TPM_TIS_REG_INT_ENABLE, |
370 | TPM_TIS_REG_INT_VECTOR, |
371 | TPM_TIS_REG_INT_STATUS, |
372 | TPM_TIS_REG_INTF_CAPABILITY, |
373 | TPM_TIS_REG_STS, |
374 | TPM_TIS_REG_DID_VID, |
375 | TPM_TIS_REG_RID, |
376 | 0xfff}; |
377 | int idx; |
378 | uint8_t locty = tpm_tis_locality_from_addr(addr); |
379 | hwaddr base = addr & ~0xfff; |
380 | TPMState *s = opaque; |
381 | |
382 | printf("tpm_tis: active locality : %d\n" |
383 | "tpm_tis: state of locality %d : %d\n" |
384 | "tpm_tis: register dump:\n" , |
385 | s->active_locty, |
386 | locty, s->loc[locty].state); |
387 | |
388 | for (idx = 0; regs[idx] != 0xfff; idx++) { |
389 | printf("tpm_tis: 0x%04x : 0x%08x\n" , regs[idx], |
390 | (int)tpm_tis_mmio_read(opaque, base + regs[idx], 4)); |
391 | } |
392 | |
393 | printf("tpm_tis: r/w offset : %d\n" |
394 | "tpm_tis: result buffer : " , |
395 | s->rw_offset); |
396 | for (idx = 0; |
397 | idx < MIN(tpm_cmd_get_size(&s->buffer), s->be_buffer_size); |
398 | idx++) { |
399 | printf("%c%02x%s" , |
400 | s->rw_offset == idx ? '>' : ' ', |
401 | s->buffer[idx], |
402 | ((idx & 0xf) == 0xf) ? "\ntpm_tis: " : "" ); |
403 | } |
404 | printf("\n" ); |
405 | } |
406 | #endif |
407 | |
408 | /* |
409 | * Read a register of the TIS interface |
410 | * See specs pages 33-63 for description of the registers |
411 | */ |
412 | static uint64_t tpm_tis_mmio_read(void *opaque, hwaddr addr, |
413 | unsigned size) |
414 | { |
415 | TPMState *s = opaque; |
416 | uint16_t offset = addr & 0xffc; |
417 | uint8_t shift = (addr & 0x3) * 8; |
418 | uint32_t val = 0xffffffff; |
419 | uint8_t locty = tpm_tis_locality_from_addr(addr); |
420 | uint32_t avail; |
421 | uint8_t v; |
422 | |
423 | if (tpm_backend_had_startup_error(s->be_driver)) { |
424 | return 0; |
425 | } |
426 | |
427 | switch (offset) { |
428 | case TPM_TIS_REG_ACCESS: |
429 | /* never show the SEIZE flag even though we use it internally */ |
430 | val = s->loc[locty].access & ~TPM_TIS_ACCESS_SEIZE; |
431 | /* the pending flag is always calculated */ |
432 | if (tpm_tis_check_request_use_except(s, locty)) { |
433 | val |= TPM_TIS_ACCESS_PENDING_REQUEST; |
434 | } |
435 | val |= !tpm_backend_get_tpm_established_flag(s->be_driver); |
436 | break; |
437 | case TPM_TIS_REG_INT_ENABLE: |
438 | val = s->loc[locty].inte; |
439 | break; |
440 | case TPM_TIS_REG_INT_VECTOR: |
441 | val = s->irq_num; |
442 | break; |
443 | case TPM_TIS_REG_INT_STATUS: |
444 | val = s->loc[locty].ints; |
445 | break; |
446 | case TPM_TIS_REG_INTF_CAPABILITY: |
447 | switch (s->be_tpm_version) { |
448 | case TPM_VERSION_UNSPEC: |
449 | val = 0; |
450 | break; |
451 | case TPM_VERSION_1_2: |
452 | val = TPM_TIS_CAPABILITIES_SUPPORTED1_3; |
453 | break; |
454 | case TPM_VERSION_2_0: |
455 | val = TPM_TIS_CAPABILITIES_SUPPORTED2_0; |
456 | break; |
457 | } |
458 | break; |
459 | case TPM_TIS_REG_STS: |
460 | if (s->active_locty == locty) { |
461 | if ((s->loc[locty].sts & TPM_TIS_STS_DATA_AVAILABLE)) { |
462 | val = TPM_TIS_BURST_COUNT( |
463 | MIN(tpm_cmd_get_size(&s->buffer), |
464 | s->be_buffer_size) |
465 | - s->rw_offset) | s->loc[locty].sts; |
466 | } else { |
467 | avail = s->be_buffer_size - s->rw_offset; |
468 | /* |
469 | * byte-sized reads should not return 0x00 for 0x100 |
470 | * available bytes. |
471 | */ |
472 | if (size == 1 && avail > 0xff) { |
473 | avail = 0xff; |
474 | } |
475 | val = TPM_TIS_BURST_COUNT(avail) | s->loc[locty].sts; |
476 | } |
477 | } |
478 | break; |
479 | case TPM_TIS_REG_DATA_FIFO: |
480 | case TPM_TIS_REG_DATA_XFIFO ... TPM_TIS_REG_DATA_XFIFO_END: |
481 | if (s->active_locty == locty) { |
482 | if (size > 4 - (addr & 0x3)) { |
483 | /* prevent access beyond FIFO */ |
484 | size = 4 - (addr & 0x3); |
485 | } |
486 | val = 0; |
487 | shift = 0; |
488 | while (size > 0) { |
489 | switch (s->loc[locty].state) { |
490 | case TPM_TIS_STATE_COMPLETION: |
491 | v = tpm_tis_data_read(s, locty); |
492 | break; |
493 | default: |
494 | v = TPM_TIS_NO_DATA_BYTE; |
495 | break; |
496 | } |
497 | val |= (v << shift); |
498 | shift += 8; |
499 | size--; |
500 | } |
501 | shift = 0; /* no more adjustments */ |
502 | } |
503 | break; |
504 | case TPM_TIS_REG_INTERFACE_ID: |
505 | val = s->loc[locty].iface_id; |
506 | break; |
507 | case TPM_TIS_REG_DID_VID: |
508 | val = (TPM_TIS_TPM_DID << 16) | TPM_TIS_TPM_VID; |
509 | break; |
510 | case TPM_TIS_REG_RID: |
511 | val = TPM_TIS_TPM_RID; |
512 | break; |
513 | #ifdef DEBUG_TIS |
514 | case TPM_TIS_REG_DEBUG: |
515 | tpm_tis_dump_state(opaque, addr); |
516 | break; |
517 | #endif |
518 | } |
519 | |
520 | if (shift) { |
521 | val >>= shift; |
522 | } |
523 | |
524 | trace_tpm_tis_mmio_read(size, addr, val); |
525 | |
526 | return val; |
527 | } |
528 | |
529 | /* |
530 | * Write a value to a register of the TIS interface |
531 | * See specs pages 33-63 for description of the registers |
532 | */ |
533 | static void tpm_tis_mmio_write(void *opaque, hwaddr addr, |
534 | uint64_t val, unsigned size) |
535 | { |
536 | TPMState *s = opaque; |
537 | uint16_t off = addr & 0xffc; |
538 | uint8_t shift = (addr & 0x3) * 8; |
539 | uint8_t locty = tpm_tis_locality_from_addr(addr); |
540 | uint8_t active_locty, l; |
541 | int c, set_new_locty = 1; |
542 | uint16_t len; |
543 | uint32_t mask = (size == 1) ? 0xff : ((size == 2) ? 0xffff : ~0); |
544 | |
545 | trace_tpm_tis_mmio_write(size, addr, val); |
546 | |
547 | if (locty == 4) { |
548 | trace_tpm_tis_mmio_write_locty4(); |
549 | return; |
550 | } |
551 | |
552 | if (tpm_backend_had_startup_error(s->be_driver)) { |
553 | return; |
554 | } |
555 | |
556 | val &= mask; |
557 | |
558 | if (shift) { |
559 | val <<= shift; |
560 | mask <<= shift; |
561 | } |
562 | |
563 | mask ^= 0xffffffff; |
564 | |
565 | switch (off) { |
566 | case TPM_TIS_REG_ACCESS: |
567 | |
568 | if ((val & TPM_TIS_ACCESS_SEIZE)) { |
569 | val &= ~(TPM_TIS_ACCESS_REQUEST_USE | |
570 | TPM_TIS_ACCESS_ACTIVE_LOCALITY); |
571 | } |
572 | |
573 | active_locty = s->active_locty; |
574 | |
575 | if ((val & TPM_TIS_ACCESS_ACTIVE_LOCALITY)) { |
576 | /* give up locality if currently owned */ |
577 | if (s->active_locty == locty) { |
578 | trace_tpm_tis_mmio_write_release_locty(locty); |
579 | |
580 | uint8_t newlocty = TPM_TIS_NO_LOCALITY; |
581 | /* anybody wants the locality ? */ |
582 | for (c = TPM_TIS_NUM_LOCALITIES - 1; c >= 0; c--) { |
583 | if ((s->loc[c].access & TPM_TIS_ACCESS_REQUEST_USE)) { |
584 | trace_tpm_tis_mmio_write_locty_req_use(c); |
585 | newlocty = c; |
586 | break; |
587 | } |
588 | } |
589 | trace_tpm_tis_mmio_write_next_locty(newlocty); |
590 | |
591 | if (TPM_TIS_IS_VALID_LOCTY(newlocty)) { |
592 | set_new_locty = 0; |
593 | tpm_tis_prep_abort(s, locty, newlocty); |
594 | } else { |
595 | active_locty = TPM_TIS_NO_LOCALITY; |
596 | } |
597 | } else { |
598 | /* not currently the owner; clear a pending request */ |
599 | s->loc[locty].access &= ~TPM_TIS_ACCESS_REQUEST_USE; |
600 | } |
601 | } |
602 | |
603 | if ((val & TPM_TIS_ACCESS_BEEN_SEIZED)) { |
604 | s->loc[locty].access &= ~TPM_TIS_ACCESS_BEEN_SEIZED; |
605 | } |
606 | |
607 | if ((val & TPM_TIS_ACCESS_SEIZE)) { |
608 | /* |
609 | * allow seize if a locality is active and the requesting |
610 | * locality is higher than the one that's active |
611 | * OR |
612 | * allow seize for requesting locality if no locality is |
613 | * active |
614 | */ |
615 | while ((TPM_TIS_IS_VALID_LOCTY(s->active_locty) && |
616 | locty > s->active_locty) || |
617 | !TPM_TIS_IS_VALID_LOCTY(s->active_locty)) { |
618 | bool higher_seize = FALSE; |
619 | |
620 | /* already a pending SEIZE ? */ |
621 | if ((s->loc[locty].access & TPM_TIS_ACCESS_SEIZE)) { |
622 | break; |
623 | } |
624 | |
625 | /* check for ongoing seize by a higher locality */ |
626 | for (l = locty + 1; l < TPM_TIS_NUM_LOCALITIES; l++) { |
627 | if ((s->loc[l].access & TPM_TIS_ACCESS_SEIZE)) { |
628 | higher_seize = TRUE; |
629 | break; |
630 | } |
631 | } |
632 | |
633 | if (higher_seize) { |
634 | break; |
635 | } |
636 | |
637 | /* cancel any seize by a lower locality */ |
638 | for (l = 0; l < locty; l++) { |
639 | s->loc[l].access &= ~TPM_TIS_ACCESS_SEIZE; |
640 | } |
641 | |
642 | s->loc[locty].access |= TPM_TIS_ACCESS_SEIZE; |
643 | |
644 | trace_tpm_tis_mmio_write_locty_seized(locty, s->active_locty); |
645 | trace_tpm_tis_mmio_write_init_abort(); |
646 | |
647 | set_new_locty = 0; |
648 | tpm_tis_prep_abort(s, s->active_locty, locty); |
649 | break; |
650 | } |
651 | } |
652 | |
653 | if ((val & TPM_TIS_ACCESS_REQUEST_USE)) { |
654 | if (s->active_locty != locty) { |
655 | if (TPM_TIS_IS_VALID_LOCTY(s->active_locty)) { |
656 | s->loc[locty].access |= TPM_TIS_ACCESS_REQUEST_USE; |
657 | } else { |
658 | /* no locality active -> make this one active now */ |
659 | active_locty = locty; |
660 | } |
661 | } |
662 | } |
663 | |
664 | if (set_new_locty) { |
665 | tpm_tis_new_active_locality(s, active_locty); |
666 | } |
667 | |
668 | break; |
669 | case TPM_TIS_REG_INT_ENABLE: |
670 | if (s->active_locty != locty) { |
671 | break; |
672 | } |
673 | |
674 | s->loc[locty].inte &= mask; |
675 | s->loc[locty].inte |= (val & (TPM_TIS_INT_ENABLED | |
676 | TPM_TIS_INT_POLARITY_MASK | |
677 | TPM_TIS_INTERRUPTS_SUPPORTED)); |
678 | break; |
679 | case TPM_TIS_REG_INT_VECTOR: |
680 | /* hard wired -- ignore */ |
681 | break; |
682 | case TPM_TIS_REG_INT_STATUS: |
683 | if (s->active_locty != locty) { |
684 | break; |
685 | } |
686 | |
687 | /* clearing of interrupt flags */ |
688 | if (((val & TPM_TIS_INTERRUPTS_SUPPORTED)) && |
689 | (s->loc[locty].ints & TPM_TIS_INTERRUPTS_SUPPORTED)) { |
690 | s->loc[locty].ints &= ~val; |
691 | if (s->loc[locty].ints == 0) { |
692 | qemu_irq_lower(s->irq); |
693 | trace_tpm_tis_mmio_write_lowering_irq(); |
694 | } |
695 | } |
696 | s->loc[locty].ints &= ~(val & TPM_TIS_INTERRUPTS_SUPPORTED); |
697 | break; |
698 | case TPM_TIS_REG_STS: |
699 | if (s->active_locty != locty) { |
700 | break; |
701 | } |
702 | |
703 | if (s->be_tpm_version == TPM_VERSION_2_0) { |
704 | /* some flags that are only supported for TPM 2 */ |
705 | if (val & TPM_TIS_STS_COMMAND_CANCEL) { |
706 | if (s->loc[locty].state == TPM_TIS_STATE_EXECUTION) { |
707 | /* |
708 | * request the backend to cancel. Some backends may not |
709 | * support it |
710 | */ |
711 | tpm_backend_cancel_cmd(s->be_driver); |
712 | } |
713 | } |
714 | |
715 | if (val & TPM_TIS_STS_RESET_ESTABLISHMENT_BIT) { |
716 | if (locty == 3 || locty == 4) { |
717 | tpm_backend_reset_tpm_established_flag(s->be_driver, locty); |
718 | } |
719 | } |
720 | } |
721 | |
722 | val &= (TPM_TIS_STS_COMMAND_READY | TPM_TIS_STS_TPM_GO | |
723 | TPM_TIS_STS_RESPONSE_RETRY); |
724 | |
725 | if (val == TPM_TIS_STS_COMMAND_READY) { |
726 | switch (s->loc[locty].state) { |
727 | |
728 | case TPM_TIS_STATE_READY: |
729 | s->rw_offset = 0; |
730 | break; |
731 | |
732 | case TPM_TIS_STATE_IDLE: |
733 | tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_COMMAND_READY); |
734 | s->loc[locty].state = TPM_TIS_STATE_READY; |
735 | tpm_tis_raise_irq(s, locty, TPM_TIS_INT_COMMAND_READY); |
736 | break; |
737 | |
738 | case TPM_TIS_STATE_EXECUTION: |
739 | case TPM_TIS_STATE_RECEPTION: |
740 | /* abort currently running command */ |
741 | trace_tpm_tis_mmio_write_init_abort(); |
742 | tpm_tis_prep_abort(s, locty, locty); |
743 | break; |
744 | |
745 | case TPM_TIS_STATE_COMPLETION: |
746 | s->rw_offset = 0; |
747 | /* shortcut to ready state with C/R set */ |
748 | s->loc[locty].state = TPM_TIS_STATE_READY; |
749 | if (!(s->loc[locty].sts & TPM_TIS_STS_COMMAND_READY)) { |
750 | tpm_tis_sts_set(&s->loc[locty], |
751 | TPM_TIS_STS_COMMAND_READY); |
752 | tpm_tis_raise_irq(s, locty, TPM_TIS_INT_COMMAND_READY); |
753 | } |
754 | s->loc[locty].sts &= ~(TPM_TIS_STS_DATA_AVAILABLE); |
755 | break; |
756 | |
757 | } |
758 | } else if (val == TPM_TIS_STS_TPM_GO) { |
759 | switch (s->loc[locty].state) { |
760 | case TPM_TIS_STATE_RECEPTION: |
761 | if ((s->loc[locty].sts & TPM_TIS_STS_EXPECT) == 0) { |
762 | tpm_tis_tpm_send(s, locty); |
763 | } |
764 | break; |
765 | default: |
766 | /* ignore */ |
767 | break; |
768 | } |
769 | } else if (val == TPM_TIS_STS_RESPONSE_RETRY) { |
770 | switch (s->loc[locty].state) { |
771 | case TPM_TIS_STATE_COMPLETION: |
772 | s->rw_offset = 0; |
773 | tpm_tis_sts_set(&s->loc[locty], |
774 | TPM_TIS_STS_VALID| |
775 | TPM_TIS_STS_DATA_AVAILABLE); |
776 | break; |
777 | default: |
778 | /* ignore */ |
779 | break; |
780 | } |
781 | } |
782 | break; |
783 | case TPM_TIS_REG_DATA_FIFO: |
784 | case TPM_TIS_REG_DATA_XFIFO ... TPM_TIS_REG_DATA_XFIFO_END: |
785 | /* data fifo */ |
786 | if (s->active_locty != locty) { |
787 | break; |
788 | } |
789 | |
790 | if (s->loc[locty].state == TPM_TIS_STATE_IDLE || |
791 | s->loc[locty].state == TPM_TIS_STATE_EXECUTION || |
792 | s->loc[locty].state == TPM_TIS_STATE_COMPLETION) { |
793 | /* drop the byte */ |
794 | } else { |
795 | trace_tpm_tis_mmio_write_data2send(val, size); |
796 | if (s->loc[locty].state == TPM_TIS_STATE_READY) { |
797 | s->loc[locty].state = TPM_TIS_STATE_RECEPTION; |
798 | tpm_tis_sts_set(&s->loc[locty], |
799 | TPM_TIS_STS_EXPECT | TPM_TIS_STS_VALID); |
800 | } |
801 | |
802 | val >>= shift; |
803 | if (size > 4 - (addr & 0x3)) { |
804 | /* prevent access beyond FIFO */ |
805 | size = 4 - (addr & 0x3); |
806 | } |
807 | |
808 | while ((s->loc[locty].sts & TPM_TIS_STS_EXPECT) && size > 0) { |
809 | if (s->rw_offset < s->be_buffer_size) { |
810 | s->buffer[s->rw_offset++] = |
811 | (uint8_t)val; |
812 | val >>= 8; |
813 | size--; |
814 | } else { |
815 | tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID); |
816 | } |
817 | } |
818 | |
819 | /* check for complete packet */ |
820 | if (s->rw_offset > 5 && |
821 | (s->loc[locty].sts & TPM_TIS_STS_EXPECT)) { |
822 | /* we have a packet length - see if we have all of it */ |
823 | bool need_irq = !(s->loc[locty].sts & TPM_TIS_STS_VALID); |
824 | |
825 | len = tpm_cmd_get_size(&s->buffer); |
826 | if (len > s->rw_offset) { |
827 | tpm_tis_sts_set(&s->loc[locty], |
828 | TPM_TIS_STS_EXPECT | TPM_TIS_STS_VALID); |
829 | } else { |
830 | /* packet complete */ |
831 | tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID); |
832 | } |
833 | if (need_irq) { |
834 | tpm_tis_raise_irq(s, locty, TPM_TIS_INT_STS_VALID); |
835 | } |
836 | } |
837 | } |
838 | break; |
839 | case TPM_TIS_REG_INTERFACE_ID: |
840 | if (val & TPM_TIS_IFACE_ID_INT_SEL_LOCK) { |
841 | for (l = 0; l < TPM_TIS_NUM_LOCALITIES; l++) { |
842 | s->loc[l].iface_id |= TPM_TIS_IFACE_ID_INT_SEL_LOCK; |
843 | } |
844 | } |
845 | break; |
846 | } |
847 | } |
848 | |
849 | static const MemoryRegionOps tpm_tis_memory_ops = { |
850 | .read = tpm_tis_mmio_read, |
851 | .write = tpm_tis_mmio_write, |
852 | .endianness = DEVICE_LITTLE_ENDIAN, |
853 | .valid = { |
854 | .min_access_size = 1, |
855 | .max_access_size = 4, |
856 | }, |
857 | }; |
858 | |
859 | /* |
860 | * Get the TPMVersion of the backend device being used |
861 | */ |
862 | static enum TPMVersion tpm_tis_get_tpm_version(TPMIf *ti) |
863 | { |
864 | TPMState *s = TPM(ti); |
865 | |
866 | if (tpm_backend_had_startup_error(s->be_driver)) { |
867 | return TPM_VERSION_UNSPEC; |
868 | } |
869 | |
870 | return tpm_backend_get_tpm_version(s->be_driver); |
871 | } |
872 | |
873 | /* |
874 | * This function is called when the machine starts, resets or due to |
875 | * S3 resume. |
876 | */ |
877 | static void tpm_tis_reset(DeviceState *dev) |
878 | { |
879 | TPMState *s = TPM(dev); |
880 | int c; |
881 | |
882 | s->be_tpm_version = tpm_backend_get_tpm_version(s->be_driver); |
883 | s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->be_driver), |
884 | TPM_TIS_BUFFER_MAX); |
885 | |
886 | if (s->ppi_enabled) { |
887 | tpm_ppi_reset(&s->ppi); |
888 | } |
889 | tpm_backend_reset(s->be_driver); |
890 | |
891 | s->active_locty = TPM_TIS_NO_LOCALITY; |
892 | s->next_locty = TPM_TIS_NO_LOCALITY; |
893 | s->aborting_locty = TPM_TIS_NO_LOCALITY; |
894 | |
895 | for (c = 0; c < TPM_TIS_NUM_LOCALITIES; c++) { |
896 | s->loc[c].access = TPM_TIS_ACCESS_TPM_REG_VALID_STS; |
897 | switch (s->be_tpm_version) { |
898 | case TPM_VERSION_UNSPEC: |
899 | break; |
900 | case TPM_VERSION_1_2: |
901 | s->loc[c].sts = TPM_TIS_STS_TPM_FAMILY1_2; |
902 | s->loc[c].iface_id = TPM_TIS_IFACE_ID_SUPPORTED_FLAGS1_3; |
903 | break; |
904 | case TPM_VERSION_2_0: |
905 | s->loc[c].sts = TPM_TIS_STS_TPM_FAMILY2_0; |
906 | s->loc[c].iface_id = TPM_TIS_IFACE_ID_SUPPORTED_FLAGS2_0; |
907 | break; |
908 | } |
909 | s->loc[c].inte = TPM_TIS_INT_POLARITY_LOW_LEVEL; |
910 | s->loc[c].ints = 0; |
911 | s->loc[c].state = TPM_TIS_STATE_IDLE; |
912 | |
913 | s->rw_offset = 0; |
914 | } |
915 | |
916 | if (tpm_backend_startup_tpm(s->be_driver, s->be_buffer_size) < 0) { |
917 | exit(1); |
918 | } |
919 | } |
920 | |
921 | /* persistent state handling */ |
922 | |
923 | static int tpm_tis_pre_save(void *opaque) |
924 | { |
925 | TPMState *s = opaque; |
926 | uint8_t locty = s->active_locty; |
927 | |
928 | trace_tpm_tis_pre_save(locty, s->rw_offset); |
929 | |
930 | if (DEBUG_TIS) { |
931 | tpm_tis_dump_state(opaque, 0); |
932 | } |
933 | |
934 | /* |
935 | * Synchronize with backend completion. |
936 | */ |
937 | tpm_backend_finish_sync(s->be_driver); |
938 | |
939 | return 0; |
940 | } |
941 | |
942 | static const VMStateDescription vmstate_locty = { |
943 | .name = "tpm-tis/locty" , |
944 | .version_id = 0, |
945 | .fields = (VMStateField[]) { |
946 | VMSTATE_UINT32(state, TPMLocality), |
947 | VMSTATE_UINT32(inte, TPMLocality), |
948 | VMSTATE_UINT32(ints, TPMLocality), |
949 | VMSTATE_UINT8(access, TPMLocality), |
950 | VMSTATE_UINT32(sts, TPMLocality), |
951 | VMSTATE_UINT32(iface_id, TPMLocality), |
952 | VMSTATE_END_OF_LIST(), |
953 | } |
954 | }; |
955 | |
956 | static const VMStateDescription vmstate_tpm_tis = { |
957 | .name = "tpm-tis" , |
958 | .version_id = 0, |
959 | .pre_save = tpm_tis_pre_save, |
960 | .fields = (VMStateField[]) { |
961 | VMSTATE_BUFFER(buffer, TPMState), |
962 | VMSTATE_UINT16(rw_offset, TPMState), |
963 | VMSTATE_UINT8(active_locty, TPMState), |
964 | VMSTATE_UINT8(aborting_locty, TPMState), |
965 | VMSTATE_UINT8(next_locty, TPMState), |
966 | |
967 | VMSTATE_STRUCT_ARRAY(loc, TPMState, TPM_TIS_NUM_LOCALITIES, 0, |
968 | vmstate_locty, TPMLocality), |
969 | |
970 | VMSTATE_END_OF_LIST() |
971 | } |
972 | }; |
973 | |
974 | static Property tpm_tis_properties[] = { |
975 | DEFINE_PROP_UINT32("irq" , TPMState, irq_num, TPM_TIS_IRQ), |
976 | DEFINE_PROP_TPMBE("tpmdev" , TPMState, be_driver), |
977 | DEFINE_PROP_BOOL("ppi" , TPMState, ppi_enabled, true), |
978 | DEFINE_PROP_END_OF_LIST(), |
979 | }; |
980 | |
981 | static void tpm_tis_realizefn(DeviceState *dev, Error **errp) |
982 | { |
983 | TPMState *s = TPM(dev); |
984 | |
985 | if (!tpm_find()) { |
986 | error_setg(errp, "at most one TPM device is permitted" ); |
987 | return; |
988 | } |
989 | |
990 | if (!s->be_driver) { |
991 | error_setg(errp, "'tpmdev' property is required" ); |
992 | return; |
993 | } |
994 | if (s->irq_num > 15) { |
995 | error_setg(errp, "IRQ %d is outside valid range of 0 to 15" , |
996 | s->irq_num); |
997 | return; |
998 | } |
999 | |
1000 | isa_init_irq(&s->busdev, &s->irq, s->irq_num); |
1001 | |
1002 | memory_region_add_subregion(isa_address_space(ISA_DEVICE(dev)), |
1003 | TPM_TIS_ADDR_BASE, &s->mmio); |
1004 | |
1005 | if (s->ppi_enabled) { |
1006 | tpm_ppi_init(&s->ppi, isa_address_space(ISA_DEVICE(dev)), |
1007 | TPM_PPI_ADDR_BASE, OBJECT(s)); |
1008 | } |
1009 | } |
1010 | |
1011 | static void tpm_tis_initfn(Object *obj) |
1012 | { |
1013 | TPMState *s = TPM(obj); |
1014 | |
1015 | memory_region_init_io(&s->mmio, OBJECT(s), &tpm_tis_memory_ops, |
1016 | s, "tpm-tis-mmio" , |
1017 | TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT); |
1018 | } |
1019 | |
1020 | static void tpm_tis_class_init(ObjectClass *klass, void *data) |
1021 | { |
1022 | DeviceClass *dc = DEVICE_CLASS(klass); |
1023 | TPMIfClass *tc = TPM_IF_CLASS(klass); |
1024 | |
1025 | dc->realize = tpm_tis_realizefn; |
1026 | dc->props = tpm_tis_properties; |
1027 | dc->reset = tpm_tis_reset; |
1028 | dc->vmsd = &vmstate_tpm_tis; |
1029 | tc->model = TPM_MODEL_TPM_TIS; |
1030 | tc->get_version = tpm_tis_get_tpm_version; |
1031 | tc->request_completed = tpm_tis_request_completed; |
1032 | } |
1033 | |
1034 | static const TypeInfo tpm_tis_info = { |
1035 | .name = TYPE_TPM_TIS, |
1036 | .parent = TYPE_ISA_DEVICE, |
1037 | .instance_size = sizeof(TPMState), |
1038 | .instance_init = tpm_tis_initfn, |
1039 | .class_init = tpm_tis_class_init, |
1040 | .interfaces = (InterfaceInfo[]) { |
1041 | { TYPE_TPM_IF }, |
1042 | { } |
1043 | } |
1044 | }; |
1045 | |
1046 | static void tpm_tis_register(void) |
1047 | { |
1048 | type_register_static(&tpm_tis_info); |
1049 | } |
1050 | |
1051 | type_init(tpm_tis_register) |
1052 | |