1 /* 2 * tpm_tis.c - QEMU's TPM TIS interface emulator 3 * 4 * Copyright (C) 2006,2010-2013 IBM Corporation 5 * 6 * Authors: 7 * Stefan Berger <stefanb@us.ibm.com> 8 * David Safford <safford@us.ibm.com> 9 * 10 * Xen 4 support: Andrease Niederl <andreas.niederl@iaik.tugraz.at> 11 * 12 * This work is licensed under the terms of the GNU GPL, version 2 or later. 13 * See the COPYING file in the top-level directory. 14 * 15 * Implementation of the TIS interface according to specs found at 16 * http://www.trustedcomputinggroup.org. This implementation currently 17 * supports version 1.3, 21 March 2013 18 * In the developers menu choose the PC Client section then find the TIS 19 * specification. 20 * 21 * TPM TIS for TPM 2 implementation following TCG PC Client Platform 22 * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43 23 */ 24 25 #include "qemu/osdep.h" 26 #include "hw/isa/isa.h" 27 #include "qapi/error.h" 28 29 #include "hw/acpi/tpm.h" 30 #include "hw/pci/pci_ids.h" 31 #include "sysemu/tpm_backend.h" 32 #include "tpm_int.h" 33 #include "tpm_util.h" 34 35 #define TPM_TIS_NUM_LOCALITIES 5 /* per spec */ 36 #define TPM_TIS_LOCALITY_SHIFT 12 37 #define TPM_TIS_NO_LOCALITY 0xff 38 39 #define TPM_TIS_IS_VALID_LOCTY(x) ((x) < TPM_TIS_NUM_LOCALITIES) 40 41 #define TPM_TIS_BUFFER_MAX 4096 42 43 typedef enum { 44 TPM_TIS_STATE_IDLE = 0, 45 TPM_TIS_STATE_READY, 46 TPM_TIS_STATE_COMPLETION, 47 TPM_TIS_STATE_EXECUTION, 48 TPM_TIS_STATE_RECEPTION, 49 } TPMTISState; 50 51 typedef struct TPMSizedBuffer { 52 uint32_t size; 53 uint8_t *buffer; 54 } TPMSizedBuffer; 55 56 /* locality data -- all fields are persisted */ 57 typedef struct TPMLocality { 58 TPMTISState state; 59 uint8_t access; 60 uint32_t sts; 61 uint32_t iface_id; 62 uint32_t inte; 63 uint32_t ints; 64 65 uint16_t w_offset; 66 uint16_t r_offset; 67 unsigned char w_buffer[TPM_TIS_BUFFER_MAX]; 68 unsigned char r_buffer[TPM_TIS_BUFFER_MAX]; 69 } TPMLocality; 70 71 typedef struct TPMState { 72 ISADevice busdev; 73 MemoryRegion mmio; 74 75 uint32_t offset; 76 uint8_t buf[TPM_TIS_BUFFER_MAX]; 77 78 uint8_t active_locty; 79 uint8_t aborting_locty; 80 uint8_t next_locty; 81 82 TPMLocality loc[TPM_TIS_NUM_LOCALITIES]; 83 84 qemu_irq irq; 85 uint32_t irq_num; 86 87 TPMBackendCmd cmd; 88 89 TPMBackend *be_driver; 90 TPMVersion be_tpm_version; 91 92 size_t be_buffer_size; 93 } TPMState; 94 95 #define TPM(obj) OBJECT_CHECK(TPMState, (obj), TYPE_TPM_TIS) 96 97 #define DEBUG_TIS 0 98 99 #define DPRINTF(fmt, ...) do { \ 100 if (DEBUG_TIS) { \ 101 printf(fmt, ## __VA_ARGS__); \ 102 } \ 103 } while (0); 104 105 /* tis registers */ 106 #define TPM_TIS_REG_ACCESS 0x00 107 #define TPM_TIS_REG_INT_ENABLE 0x08 108 #define TPM_TIS_REG_INT_VECTOR 0x0c 109 #define TPM_TIS_REG_INT_STATUS 0x10 110 #define TPM_TIS_REG_INTF_CAPABILITY 0x14 111 #define TPM_TIS_REG_STS 0x18 112 #define TPM_TIS_REG_DATA_FIFO 0x24 113 #define TPM_TIS_REG_INTERFACE_ID 0x30 114 #define TPM_TIS_REG_DATA_XFIFO 0x80 115 #define TPM_TIS_REG_DATA_XFIFO_END 0xbc 116 #define TPM_TIS_REG_DID_VID 0xf00 117 #define TPM_TIS_REG_RID 0xf04 118 119 /* vendor-specific registers */ 120 #define TPM_TIS_REG_DEBUG 0xf90 121 122 #define TPM_TIS_STS_TPM_FAMILY_MASK (0x3 << 26)/* TPM 2.0 */ 123 #define TPM_TIS_STS_TPM_FAMILY1_2 (0 << 26) /* TPM 2.0 */ 124 #define TPM_TIS_STS_TPM_FAMILY2_0 (1 << 26) /* TPM 2.0 */ 125 #define TPM_TIS_STS_RESET_ESTABLISHMENT_BIT (1 << 25) /* TPM 2.0 */ 126 #define TPM_TIS_STS_COMMAND_CANCEL (1 << 24) /* TPM 2.0 */ 127 128 #define TPM_TIS_STS_VALID (1 << 7) 129 #define TPM_TIS_STS_COMMAND_READY (1 << 6) 130 #define TPM_TIS_STS_TPM_GO (1 << 5) 131 #define TPM_TIS_STS_DATA_AVAILABLE (1 << 4) 132 #define TPM_TIS_STS_EXPECT (1 << 3) 133 #define TPM_TIS_STS_SELFTEST_DONE (1 << 2) 134 #define TPM_TIS_STS_RESPONSE_RETRY (1 << 1) 135 136 #define TPM_TIS_BURST_COUNT_SHIFT 8 137 #define TPM_TIS_BURST_COUNT(X) \ 138 ((X) << TPM_TIS_BURST_COUNT_SHIFT) 139 140 #define TPM_TIS_ACCESS_TPM_REG_VALID_STS (1 << 7) 141 #define TPM_TIS_ACCESS_ACTIVE_LOCALITY (1 << 5) 142 #define TPM_TIS_ACCESS_BEEN_SEIZED (1 << 4) 143 #define TPM_TIS_ACCESS_SEIZE (1 << 3) 144 #define TPM_TIS_ACCESS_PENDING_REQUEST (1 << 2) 145 #define TPM_TIS_ACCESS_REQUEST_USE (1 << 1) 146 #define TPM_TIS_ACCESS_TPM_ESTABLISHMENT (1 << 0) 147 148 #define TPM_TIS_INT_ENABLED (1 << 31) 149 #define TPM_TIS_INT_DATA_AVAILABLE (1 << 0) 150 #define TPM_TIS_INT_STS_VALID (1 << 1) 151 #define TPM_TIS_INT_LOCALITY_CHANGED (1 << 2) 152 #define TPM_TIS_INT_COMMAND_READY (1 << 7) 153 154 #define TPM_TIS_INT_POLARITY_MASK (3 << 3) 155 #define TPM_TIS_INT_POLARITY_LOW_LEVEL (1 << 3) 156 157 #define TPM_TIS_INTERRUPTS_SUPPORTED (TPM_TIS_INT_LOCALITY_CHANGED | \ 158 TPM_TIS_INT_DATA_AVAILABLE | \ 159 TPM_TIS_INT_STS_VALID | \ 160 TPM_TIS_INT_COMMAND_READY) 161 162 #define TPM_TIS_CAP_INTERFACE_VERSION1_3 (2 << 28) 163 #define TPM_TIS_CAP_INTERFACE_VERSION1_3_FOR_TPM2_0 (3 << 28) 164 #define TPM_TIS_CAP_DATA_TRANSFER_64B (3 << 9) 165 #define TPM_TIS_CAP_DATA_TRANSFER_LEGACY (0 << 9) 166 #define TPM_TIS_CAP_BURST_COUNT_DYNAMIC (0 << 8) 167 #define TPM_TIS_CAP_INTERRUPT_LOW_LEVEL (1 << 4) /* support is mandatory */ 168 #define TPM_TIS_CAPABILITIES_SUPPORTED1_3 \ 169 (TPM_TIS_CAP_INTERRUPT_LOW_LEVEL | \ 170 TPM_TIS_CAP_BURST_COUNT_DYNAMIC | \ 171 TPM_TIS_CAP_DATA_TRANSFER_64B | \ 172 TPM_TIS_CAP_INTERFACE_VERSION1_3 | \ 173 TPM_TIS_INTERRUPTS_SUPPORTED) 174 175 #define TPM_TIS_CAPABILITIES_SUPPORTED2_0 \ 176 (TPM_TIS_CAP_INTERRUPT_LOW_LEVEL | \ 177 TPM_TIS_CAP_BURST_COUNT_DYNAMIC | \ 178 TPM_TIS_CAP_DATA_TRANSFER_64B | \ 179 TPM_TIS_CAP_INTERFACE_VERSION1_3_FOR_TPM2_0 | \ 180 TPM_TIS_INTERRUPTS_SUPPORTED) 181 182 #define TPM_TIS_IFACE_ID_INTERFACE_TIS1_3 (0xf) /* TPM 2.0 */ 183 #define TPM_TIS_IFACE_ID_INTERFACE_FIFO (0x0) /* TPM 2.0 */ 184 #define TPM_TIS_IFACE_ID_INTERFACE_VER_FIFO (0 << 4) /* TPM 2.0 */ 185 #define TPM_TIS_IFACE_ID_CAP_5_LOCALITIES (1 << 8) /* TPM 2.0 */ 186 #define TPM_TIS_IFACE_ID_CAP_TIS_SUPPORTED (1 << 13) /* TPM 2.0 */ 187 #define TPM_TIS_IFACE_ID_INT_SEL_LOCK (1 << 19) /* TPM 2.0 */ 188 189 #define TPM_TIS_IFACE_ID_SUPPORTED_FLAGS1_3 \ 190 (TPM_TIS_IFACE_ID_INTERFACE_TIS1_3 | \ 191 (~0u << 4)/* all of it is don't care */) 192 193 /* if backend was a TPM 2.0: */ 194 #define TPM_TIS_IFACE_ID_SUPPORTED_FLAGS2_0 \ 195 (TPM_TIS_IFACE_ID_INTERFACE_FIFO | \ 196 TPM_TIS_IFACE_ID_INTERFACE_VER_FIFO | \ 197 TPM_TIS_IFACE_ID_CAP_5_LOCALITIES | \ 198 TPM_TIS_IFACE_ID_CAP_TIS_SUPPORTED) 199 200 #define TPM_TIS_TPM_DID 0x0001 201 #define TPM_TIS_TPM_VID PCI_VENDOR_ID_IBM 202 #define TPM_TIS_TPM_RID 0x0001 203 204 #define TPM_TIS_NO_DATA_BYTE 0xff 205 206 /* local prototypes */ 207 208 static uint64_t tpm_tis_mmio_read(void *opaque, hwaddr addr, 209 unsigned size); 210 211 /* utility functions */ 212 213 static uint8_t tpm_tis_locality_from_addr(hwaddr addr) 214 { 215 return (uint8_t)((addr >> TPM_TIS_LOCALITY_SHIFT) & 0x7); 216 } 217 218 static void tpm_tis_show_buffer(const unsigned char *buffer, 219 size_t buffer_size, const char *string) 220 { 221 #ifdef DEBUG_TIS 222 uint32_t len, i; 223 224 len = MIN(tpm_cmd_get_size(buffer), buffer_size); 225 DPRINTF("tpm_tis: %s length = %d\n", string, len); 226 for (i = 0; i < len; i++) { 227 if (i && !(i % 16)) { 228 DPRINTF("\n"); 229 } 230 DPRINTF("%.2X ", buffer[i]); 231 } 232 DPRINTF("\n"); 233 #endif 234 } 235 236 /* 237 * Set the given flags in the STS register by clearing the register but 238 * preserving the SELFTEST_DONE and TPM_FAMILY_MASK flags and then setting 239 * the new flags. 240 * 241 * The SELFTEST_DONE flag is acquired from the backend that determines it by 242 * peeking into TPM commands. 243 * 244 * A VM suspend/resume will preserve the flag by storing it into the VM 245 * device state, but the backend will not remember it when QEMU is started 246 * again. Therefore, we cache the flag here. Once set, it will not be unset 247 * except by a reset. 248 */ 249 static void tpm_tis_sts_set(TPMLocality *l, uint32_t flags) 250 { 251 l->sts &= TPM_TIS_STS_SELFTEST_DONE | TPM_TIS_STS_TPM_FAMILY_MASK; 252 l->sts |= flags; 253 } 254 255 /* 256 * Send a request to the TPM. 257 */ 258 static void tpm_tis_tpm_send(TPMState *s, uint8_t locty) 259 { 260 TPMLocality *locty_data = &s->loc[locty]; 261 262 tpm_tis_show_buffer(s->loc[locty].w_buffer, s->be_buffer_size, 263 "tpm_tis: To TPM"); 264 265 /* 266 * w_offset serves as length indicator for length of data; 267 * it's reset when the response comes back 268 */ 269 s->loc[locty].state = TPM_TIS_STATE_EXECUTION; 270 271 s->cmd = (TPMBackendCmd) { 272 .locty = locty, 273 .in = locty_data->w_buffer, 274 .in_len = locty_data->w_offset, 275 .out = locty_data->r_buffer, 276 .out_len = s->be_buffer_size, 277 }; 278 279 tpm_backend_deliver_request(s->be_driver, &s->cmd); 280 } 281 282 /* raise an interrupt if allowed */ 283 static void tpm_tis_raise_irq(TPMState *s, uint8_t locty, uint32_t irqmask) 284 { 285 if (!TPM_TIS_IS_VALID_LOCTY(locty)) { 286 return; 287 } 288 289 if ((s->loc[locty].inte & TPM_TIS_INT_ENABLED) && 290 (s->loc[locty].inte & irqmask)) { 291 DPRINTF("tpm_tis: Raising IRQ for flag %08x\n", irqmask); 292 qemu_irq_raise(s->irq); 293 s->loc[locty].ints |= irqmask; 294 } 295 } 296 297 static uint32_t tpm_tis_check_request_use_except(TPMState *s, uint8_t locty) 298 { 299 uint8_t l; 300 301 for (l = 0; l < TPM_TIS_NUM_LOCALITIES; l++) { 302 if (l == locty) { 303 continue; 304 } 305 if ((s->loc[l].access & TPM_TIS_ACCESS_REQUEST_USE)) { 306 return 1; 307 } 308 } 309 310 return 0; 311 } 312 313 static void tpm_tis_new_active_locality(TPMState *s, uint8_t new_active_locty) 314 { 315 bool change = (s->active_locty != new_active_locty); 316 bool is_seize; 317 uint8_t mask; 318 319 if (change && TPM_TIS_IS_VALID_LOCTY(s->active_locty)) { 320 is_seize = TPM_TIS_IS_VALID_LOCTY(new_active_locty) && 321 s->loc[new_active_locty].access & TPM_TIS_ACCESS_SEIZE; 322 323 if (is_seize) { 324 mask = ~(TPM_TIS_ACCESS_ACTIVE_LOCALITY); 325 } else { 326 mask = ~(TPM_TIS_ACCESS_ACTIVE_LOCALITY| 327 TPM_TIS_ACCESS_REQUEST_USE); 328 } 329 /* reset flags on the old active locality */ 330 s->loc[s->active_locty].access &= mask; 331 332 if (is_seize) { 333 s->loc[s->active_locty].access |= TPM_TIS_ACCESS_BEEN_SEIZED; 334 } 335 } 336 337 s->active_locty = new_active_locty; 338 339 DPRINTF("tpm_tis: Active locality is now %d\n", s->active_locty); 340 341 if (TPM_TIS_IS_VALID_LOCTY(new_active_locty)) { 342 /* set flags on the new active locality */ 343 s->loc[new_active_locty].access |= TPM_TIS_ACCESS_ACTIVE_LOCALITY; 344 s->loc[new_active_locty].access &= ~(TPM_TIS_ACCESS_REQUEST_USE | 345 TPM_TIS_ACCESS_SEIZE); 346 } 347 348 if (change) { 349 tpm_tis_raise_irq(s, s->active_locty, TPM_TIS_INT_LOCALITY_CHANGED); 350 } 351 } 352 353 /* abort -- this function switches the locality */ 354 static void tpm_tis_abort(TPMState *s, uint8_t locty) 355 { 356 s->loc[locty].r_offset = 0; 357 s->loc[locty].w_offset = 0; 358 359 DPRINTF("tpm_tis: tis_abort: new active locality is %d\n", s->next_locty); 360 361 /* 362 * Need to react differently depending on who's aborting now and 363 * which locality will become active afterwards. 364 */ 365 if (s->aborting_locty == s->next_locty) { 366 s->loc[s->aborting_locty].state = TPM_TIS_STATE_READY; 367 tpm_tis_sts_set(&s->loc[s->aborting_locty], 368 TPM_TIS_STS_COMMAND_READY); 369 tpm_tis_raise_irq(s, s->aborting_locty, TPM_TIS_INT_COMMAND_READY); 370 } 371 372 /* locality after abort is another one than the current one */ 373 tpm_tis_new_active_locality(s, s->next_locty); 374 375 s->next_locty = TPM_TIS_NO_LOCALITY; 376 /* nobody's aborting a command anymore */ 377 s->aborting_locty = TPM_TIS_NO_LOCALITY; 378 } 379 380 /* prepare aborting current command */ 381 static void tpm_tis_prep_abort(TPMState *s, uint8_t locty, uint8_t newlocty) 382 { 383 uint8_t busy_locty; 384 385 s->aborting_locty = locty; 386 s->next_locty = newlocty; /* locality after successful abort */ 387 388 /* 389 * only abort a command using an interrupt if currently executing 390 * a command AND if there's a valid connection to the vTPM. 391 */ 392 for (busy_locty = 0; busy_locty < TPM_TIS_NUM_LOCALITIES; busy_locty++) { 393 if (s->loc[busy_locty].state == TPM_TIS_STATE_EXECUTION) { 394 /* 395 * request the backend to cancel. Some backends may not 396 * support it 397 */ 398 tpm_backend_cancel_cmd(s->be_driver); 399 return; 400 } 401 } 402 403 tpm_tis_abort(s, locty); 404 } 405 406 /* 407 * Callback from the TPM to indicate that the response was received. 408 */ 409 static void tpm_tis_request_completed(TPMIf *ti) 410 { 411 TPMState *s = TPM(ti); 412 uint8_t locty = s->cmd.locty; 413 uint8_t l; 414 415 if (s->cmd.selftest_done) { 416 for (l = 0; l < TPM_TIS_NUM_LOCALITIES; l++) { 417 s->loc[locty].sts |= TPM_TIS_STS_SELFTEST_DONE; 418 } 419 } 420 421 tpm_tis_sts_set(&s->loc[locty], 422 TPM_TIS_STS_VALID | TPM_TIS_STS_DATA_AVAILABLE); 423 s->loc[locty].state = TPM_TIS_STATE_COMPLETION; 424 s->loc[locty].r_offset = 0; 425 s->loc[locty].w_offset = 0; 426 427 tpm_tis_show_buffer(s->loc[locty].r_buffer, s->be_buffer_size, 428 "tpm_tis: From TPM"); 429 430 if (TPM_TIS_IS_VALID_LOCTY(s->next_locty)) { 431 tpm_tis_abort(s, locty); 432 } 433 434 tpm_tis_raise_irq(s, locty, 435 TPM_TIS_INT_DATA_AVAILABLE | TPM_TIS_INT_STS_VALID); 436 } 437 438 /* 439 * Read a byte of response data 440 */ 441 static uint32_t tpm_tis_data_read(TPMState *s, uint8_t locty) 442 { 443 uint32_t ret = TPM_TIS_NO_DATA_BYTE; 444 uint16_t len; 445 446 if ((s->loc[locty].sts & TPM_TIS_STS_DATA_AVAILABLE)) { 447 len = MIN(tpm_cmd_get_size(&s->loc[locty].r_buffer), 448 s->be_buffer_size); 449 450 ret = s->loc[locty].r_buffer[s->loc[locty].r_offset++]; 451 if (s->loc[locty].r_offset >= len) { 452 /* got last byte */ 453 tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID); 454 tpm_tis_raise_irq(s, locty, TPM_TIS_INT_STS_VALID); 455 } 456 DPRINTF("tpm_tis: tpm_tis_data_read byte 0x%02x [%d]\n", 457 ret, s->loc[locty].r_offset - 1); 458 } 459 460 return ret; 461 } 462 463 #ifdef DEBUG_TIS 464 static void tpm_tis_dump_state(void *opaque, hwaddr addr) 465 { 466 static const unsigned regs[] = { 467 TPM_TIS_REG_ACCESS, 468 TPM_TIS_REG_INT_ENABLE, 469 TPM_TIS_REG_INT_VECTOR, 470 TPM_TIS_REG_INT_STATUS, 471 TPM_TIS_REG_INTF_CAPABILITY, 472 TPM_TIS_REG_STS, 473 TPM_TIS_REG_DID_VID, 474 TPM_TIS_REG_RID, 475 0xfff}; 476 int idx; 477 uint8_t locty = tpm_tis_locality_from_addr(addr); 478 hwaddr base = addr & ~0xfff; 479 TPMState *s = opaque; 480 481 DPRINTF("tpm_tis: active locality : %d\n" 482 "tpm_tis: state of locality %d : %d\n" 483 "tpm_tis: register dump:\n", 484 s->active_locty, 485 locty, s->loc[locty].state); 486 487 for (idx = 0; regs[idx] != 0xfff; idx++) { 488 DPRINTF("tpm_tis: 0x%04x : 0x%08x\n", regs[idx], 489 (int)tpm_tis_mmio_read(opaque, base + regs[idx], 4)); 490 } 491 492 DPRINTF("tpm_tis: read offset : %d\n" 493 "tpm_tis: result buffer : ", 494 s->loc[locty].r_offset); 495 for (idx = 0; 496 idx < MIN(tpm_cmd_get_size(&s->loc[locty].r_buffer), 497 s->be_buffer_size); 498 idx++) { 499 DPRINTF("%c%02x%s", 500 s->loc[locty].r_offset == idx ? '>' : ' ', 501 s->loc[locty].r_buffer[idx], 502 ((idx & 0xf) == 0xf) ? "\ntpm_tis: " : ""); 503 } 504 DPRINTF("\n" 505 "tpm_tis: write offset : %d\n" 506 "tpm_tis: request buffer: ", 507 s->loc[locty].w_offset); 508 for (idx = 0; 509 idx < MIN(tpm_cmd_get_size(s->loc[locty].w_buffer), 510 s->be_buffer_size); 511 idx++) { 512 DPRINTF("%c%02x%s", 513 s->loc[locty].w_offset == idx ? '>' : ' ', 514 s->loc[locty].w_buffer[idx], 515 ((idx & 0xf) == 0xf) ? "\ntpm_tis: " : ""); 516 } 517 DPRINTF("\n"); 518 } 519 #endif 520 521 /* 522 * Read a register of the TIS interface 523 * See specs pages 33-63 for description of the registers 524 */ 525 static uint64_t tpm_tis_mmio_read(void *opaque, hwaddr addr, 526 unsigned size) 527 { 528 TPMState *s = opaque; 529 uint16_t offset = addr & 0xffc; 530 uint8_t shift = (addr & 0x3) * 8; 531 uint32_t val = 0xffffffff; 532 uint8_t locty = tpm_tis_locality_from_addr(addr); 533 uint32_t avail; 534 uint8_t v; 535 536 if (tpm_backend_had_startup_error(s->be_driver)) { 537 return 0; 538 } 539 540 switch (offset) { 541 case TPM_TIS_REG_ACCESS: 542 /* never show the SEIZE flag even though we use it internally */ 543 val = s->loc[locty].access & ~TPM_TIS_ACCESS_SEIZE; 544 /* the pending flag is always calculated */ 545 if (tpm_tis_check_request_use_except(s, locty)) { 546 val |= TPM_TIS_ACCESS_PENDING_REQUEST; 547 } 548 val |= !tpm_backend_get_tpm_established_flag(s->be_driver); 549 break; 550 case TPM_TIS_REG_INT_ENABLE: 551 val = s->loc[locty].inte; 552 break; 553 case TPM_TIS_REG_INT_VECTOR: 554 val = s->irq_num; 555 break; 556 case TPM_TIS_REG_INT_STATUS: 557 val = s->loc[locty].ints; 558 break; 559 case TPM_TIS_REG_INTF_CAPABILITY: 560 switch (s->be_tpm_version) { 561 case TPM_VERSION_UNSPEC: 562 val = 0; 563 break; 564 case TPM_VERSION_1_2: 565 val = TPM_TIS_CAPABILITIES_SUPPORTED1_3; 566 break; 567 case TPM_VERSION_2_0: 568 val = TPM_TIS_CAPABILITIES_SUPPORTED2_0; 569 break; 570 } 571 break; 572 case TPM_TIS_REG_STS: 573 if (s->active_locty == locty) { 574 if ((s->loc[locty].sts & TPM_TIS_STS_DATA_AVAILABLE)) { 575 val = TPM_TIS_BURST_COUNT( 576 MIN(tpm_cmd_get_size(&s->loc[locty].r_buffer), 577 s->be_buffer_size) 578 - s->loc[locty].r_offset) | s->loc[locty].sts; 579 } else { 580 avail = s->be_buffer_size - s->loc[locty].w_offset; 581 /* 582 * byte-sized reads should not return 0x00 for 0x100 583 * available bytes. 584 */ 585 if (size == 1 && avail > 0xff) { 586 avail = 0xff; 587 } 588 val = TPM_TIS_BURST_COUNT(avail) | s->loc[locty].sts; 589 } 590 } 591 break; 592 case TPM_TIS_REG_DATA_FIFO: 593 case TPM_TIS_REG_DATA_XFIFO ... TPM_TIS_REG_DATA_XFIFO_END: 594 if (s->active_locty == locty) { 595 if (size > 4 - (addr & 0x3)) { 596 /* prevent access beyond FIFO */ 597 size = 4 - (addr & 0x3); 598 } 599 val = 0; 600 shift = 0; 601 while (size > 0) { 602 switch (s->loc[locty].state) { 603 case TPM_TIS_STATE_COMPLETION: 604 v = tpm_tis_data_read(s, locty); 605 break; 606 default: 607 v = TPM_TIS_NO_DATA_BYTE; 608 break; 609 } 610 val |= (v << shift); 611 shift += 8; 612 size--; 613 } 614 shift = 0; /* no more adjustments */ 615 } 616 break; 617 case TPM_TIS_REG_INTERFACE_ID: 618 val = s->loc[locty].iface_id; 619 break; 620 case TPM_TIS_REG_DID_VID: 621 val = (TPM_TIS_TPM_DID << 16) | TPM_TIS_TPM_VID; 622 break; 623 case TPM_TIS_REG_RID: 624 val = TPM_TIS_TPM_RID; 625 break; 626 #ifdef DEBUG_TIS 627 case TPM_TIS_REG_DEBUG: 628 tpm_tis_dump_state(opaque, addr); 629 break; 630 #endif 631 } 632 633 if (shift) { 634 val >>= shift; 635 } 636 637 DPRINTF("tpm_tis: read.%u(%08x) = %08x\n", size, (int)addr, (int)val); 638 639 return val; 640 } 641 642 /* 643 * Write a value to a register of the TIS interface 644 * See specs pages 33-63 for description of the registers 645 */ 646 static void tpm_tis_mmio_write(void *opaque, hwaddr addr, 647 uint64_t val, unsigned size) 648 { 649 TPMState *s = opaque; 650 uint16_t off = addr & 0xffc; 651 uint8_t shift = (addr & 0x3) * 8; 652 uint8_t locty = tpm_tis_locality_from_addr(addr); 653 uint8_t active_locty, l; 654 int c, set_new_locty = 1; 655 uint16_t len; 656 uint32_t mask = (size == 1) ? 0xff : ((size == 2) ? 0xffff : ~0); 657 658 DPRINTF("tpm_tis: write.%u(%08x) = %08x\n", size, (int)addr, (int)val); 659 660 if (locty == 4) { 661 DPRINTF("tpm_tis: Access to locality 4 only allowed from hardware\n"); 662 return; 663 } 664 665 if (tpm_backend_had_startup_error(s->be_driver)) { 666 return; 667 } 668 669 val &= mask; 670 671 if (shift) { 672 val <<= shift; 673 mask <<= shift; 674 } 675 676 mask ^= 0xffffffff; 677 678 switch (off) { 679 case TPM_TIS_REG_ACCESS: 680 681 if ((val & TPM_TIS_ACCESS_SEIZE)) { 682 val &= ~(TPM_TIS_ACCESS_REQUEST_USE | 683 TPM_TIS_ACCESS_ACTIVE_LOCALITY); 684 } 685 686 active_locty = s->active_locty; 687 688 if ((val & TPM_TIS_ACCESS_ACTIVE_LOCALITY)) { 689 /* give up locality if currently owned */ 690 if (s->active_locty == locty) { 691 DPRINTF("tpm_tis: Releasing locality %d\n", locty); 692 693 uint8_t newlocty = TPM_TIS_NO_LOCALITY; 694 /* anybody wants the locality ? */ 695 for (c = TPM_TIS_NUM_LOCALITIES - 1; c >= 0; c--) { 696 if ((s->loc[c].access & TPM_TIS_ACCESS_REQUEST_USE)) { 697 DPRINTF("tpm_tis: Locality %d requests use.\n", c); 698 newlocty = c; 699 break; 700 } 701 } 702 DPRINTF("tpm_tis: TPM_TIS_ACCESS_ACTIVE_LOCALITY: " 703 "Next active locality: %d\n", 704 newlocty); 705 706 if (TPM_TIS_IS_VALID_LOCTY(newlocty)) { 707 set_new_locty = 0; 708 tpm_tis_prep_abort(s, locty, newlocty); 709 } else { 710 active_locty = TPM_TIS_NO_LOCALITY; 711 } 712 } else { 713 /* not currently the owner; clear a pending request */ 714 s->loc[locty].access &= ~TPM_TIS_ACCESS_REQUEST_USE; 715 } 716 } 717 718 if ((val & TPM_TIS_ACCESS_BEEN_SEIZED)) { 719 s->loc[locty].access &= ~TPM_TIS_ACCESS_BEEN_SEIZED; 720 } 721 722 if ((val & TPM_TIS_ACCESS_SEIZE)) { 723 /* 724 * allow seize if a locality is active and the requesting 725 * locality is higher than the one that's active 726 * OR 727 * allow seize for requesting locality if no locality is 728 * active 729 */ 730 while ((TPM_TIS_IS_VALID_LOCTY(s->active_locty) && 731 locty > s->active_locty) || 732 !TPM_TIS_IS_VALID_LOCTY(s->active_locty)) { 733 bool higher_seize = FALSE; 734 735 /* already a pending SEIZE ? */ 736 if ((s->loc[locty].access & TPM_TIS_ACCESS_SEIZE)) { 737 break; 738 } 739 740 /* check for ongoing seize by a higher locality */ 741 for (l = locty + 1; l < TPM_TIS_NUM_LOCALITIES; l++) { 742 if ((s->loc[l].access & TPM_TIS_ACCESS_SEIZE)) { 743 higher_seize = TRUE; 744 break; 745 } 746 } 747 748 if (higher_seize) { 749 break; 750 } 751 752 /* cancel any seize by a lower locality */ 753 for (l = 0; l < locty - 1; l++) { 754 s->loc[l].access &= ~TPM_TIS_ACCESS_SEIZE; 755 } 756 757 s->loc[locty].access |= TPM_TIS_ACCESS_SEIZE; 758 DPRINTF("tpm_tis: TPM_TIS_ACCESS_SEIZE: " 759 "Locality %d seized from locality %d\n", 760 locty, s->active_locty); 761 DPRINTF("tpm_tis: TPM_TIS_ACCESS_SEIZE: Initiating abort.\n"); 762 set_new_locty = 0; 763 tpm_tis_prep_abort(s, s->active_locty, locty); 764 break; 765 } 766 } 767 768 if ((val & TPM_TIS_ACCESS_REQUEST_USE)) { 769 if (s->active_locty != locty) { 770 if (TPM_TIS_IS_VALID_LOCTY(s->active_locty)) { 771 s->loc[locty].access |= TPM_TIS_ACCESS_REQUEST_USE; 772 } else { 773 /* no locality active -> make this one active now */ 774 active_locty = locty; 775 } 776 } 777 } 778 779 if (set_new_locty) { 780 tpm_tis_new_active_locality(s, active_locty); 781 } 782 783 break; 784 case TPM_TIS_REG_INT_ENABLE: 785 if (s->active_locty != locty) { 786 break; 787 } 788 789 s->loc[locty].inte &= mask; 790 s->loc[locty].inte |= (val & (TPM_TIS_INT_ENABLED | 791 TPM_TIS_INT_POLARITY_MASK | 792 TPM_TIS_INTERRUPTS_SUPPORTED)); 793 break; 794 case TPM_TIS_REG_INT_VECTOR: 795 /* hard wired -- ignore */ 796 break; 797 case TPM_TIS_REG_INT_STATUS: 798 if (s->active_locty != locty) { 799 break; 800 } 801 802 /* clearing of interrupt flags */ 803 if (((val & TPM_TIS_INTERRUPTS_SUPPORTED)) && 804 (s->loc[locty].ints & TPM_TIS_INTERRUPTS_SUPPORTED)) { 805 s->loc[locty].ints &= ~val; 806 if (s->loc[locty].ints == 0) { 807 qemu_irq_lower(s->irq); 808 DPRINTF("tpm_tis: Lowering IRQ\n"); 809 } 810 } 811 s->loc[locty].ints &= ~(val & TPM_TIS_INTERRUPTS_SUPPORTED); 812 break; 813 case TPM_TIS_REG_STS: 814 if (s->active_locty != locty) { 815 break; 816 } 817 818 if (s->be_tpm_version == TPM_VERSION_2_0) { 819 /* some flags that are only supported for TPM 2 */ 820 if (val & TPM_TIS_STS_COMMAND_CANCEL) { 821 if (s->loc[locty].state == TPM_TIS_STATE_EXECUTION) { 822 /* 823 * request the backend to cancel. Some backends may not 824 * support it 825 */ 826 tpm_backend_cancel_cmd(s->be_driver); 827 } 828 } 829 830 if (val & TPM_TIS_STS_RESET_ESTABLISHMENT_BIT) { 831 if (locty == 3 || locty == 4) { 832 tpm_backend_reset_tpm_established_flag(s->be_driver, locty); 833 } 834 } 835 } 836 837 val &= (TPM_TIS_STS_COMMAND_READY | TPM_TIS_STS_TPM_GO | 838 TPM_TIS_STS_RESPONSE_RETRY); 839 840 if (val == TPM_TIS_STS_COMMAND_READY) { 841 switch (s->loc[locty].state) { 842 843 case TPM_TIS_STATE_READY: 844 s->loc[locty].w_offset = 0; 845 s->loc[locty].r_offset = 0; 846 break; 847 848 case TPM_TIS_STATE_IDLE: 849 tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_COMMAND_READY); 850 s->loc[locty].state = TPM_TIS_STATE_READY; 851 tpm_tis_raise_irq(s, locty, TPM_TIS_INT_COMMAND_READY); 852 break; 853 854 case TPM_TIS_STATE_EXECUTION: 855 case TPM_TIS_STATE_RECEPTION: 856 /* abort currently running command */ 857 DPRINTF("tpm_tis: %s: Initiating abort.\n", 858 __func__); 859 tpm_tis_prep_abort(s, locty, locty); 860 break; 861 862 case TPM_TIS_STATE_COMPLETION: 863 s->loc[locty].w_offset = 0; 864 s->loc[locty].r_offset = 0; 865 /* shortcut to ready state with C/R set */ 866 s->loc[locty].state = TPM_TIS_STATE_READY; 867 if (!(s->loc[locty].sts & TPM_TIS_STS_COMMAND_READY)) { 868 tpm_tis_sts_set(&s->loc[locty], 869 TPM_TIS_STS_COMMAND_READY); 870 tpm_tis_raise_irq(s, locty, TPM_TIS_INT_COMMAND_READY); 871 } 872 s->loc[locty].sts &= ~(TPM_TIS_STS_DATA_AVAILABLE); 873 break; 874 875 } 876 } else if (val == TPM_TIS_STS_TPM_GO) { 877 switch (s->loc[locty].state) { 878 case TPM_TIS_STATE_RECEPTION: 879 if ((s->loc[locty].sts & TPM_TIS_STS_EXPECT) == 0) { 880 tpm_tis_tpm_send(s, locty); 881 } 882 break; 883 default: 884 /* ignore */ 885 break; 886 } 887 } else if (val == TPM_TIS_STS_RESPONSE_RETRY) { 888 switch (s->loc[locty].state) { 889 case TPM_TIS_STATE_COMPLETION: 890 s->loc[locty].r_offset = 0; 891 tpm_tis_sts_set(&s->loc[locty], 892 TPM_TIS_STS_VALID| 893 TPM_TIS_STS_DATA_AVAILABLE); 894 break; 895 default: 896 /* ignore */ 897 break; 898 } 899 } 900 break; 901 case TPM_TIS_REG_DATA_FIFO: 902 case TPM_TIS_REG_DATA_XFIFO ... TPM_TIS_REG_DATA_XFIFO_END: 903 /* data fifo */ 904 if (s->active_locty != locty) { 905 break; 906 } 907 908 if (s->loc[locty].state == TPM_TIS_STATE_IDLE || 909 s->loc[locty].state == TPM_TIS_STATE_EXECUTION || 910 s->loc[locty].state == TPM_TIS_STATE_COMPLETION) { 911 /* drop the byte */ 912 } else { 913 DPRINTF("tpm_tis: Data to send to TPM: %08x (size=%d)\n", 914 (int)val, size); 915 if (s->loc[locty].state == TPM_TIS_STATE_READY) { 916 s->loc[locty].state = TPM_TIS_STATE_RECEPTION; 917 tpm_tis_sts_set(&s->loc[locty], 918 TPM_TIS_STS_EXPECT | TPM_TIS_STS_VALID); 919 } 920 921 val >>= shift; 922 if (size > 4 - (addr & 0x3)) { 923 /* prevent access beyond FIFO */ 924 size = 4 - (addr & 0x3); 925 } 926 927 while ((s->loc[locty].sts & TPM_TIS_STS_EXPECT) && size > 0) { 928 if (s->loc[locty].w_offset < s->be_buffer_size) { 929 s->loc[locty].w_buffer[s->loc[locty].w_offset++] = 930 (uint8_t)val; 931 val >>= 8; 932 size--; 933 } else { 934 tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID); 935 } 936 } 937 938 /* check for complete packet */ 939 if (s->loc[locty].w_offset > 5 && 940 (s->loc[locty].sts & TPM_TIS_STS_EXPECT)) { 941 /* we have a packet length - see if we have all of it */ 942 bool need_irq = !(s->loc[locty].sts & TPM_TIS_STS_VALID); 943 944 len = tpm_cmd_get_size(&s->loc[locty].w_buffer); 945 if (len > s->loc[locty].w_offset) { 946 tpm_tis_sts_set(&s->loc[locty], 947 TPM_TIS_STS_EXPECT | TPM_TIS_STS_VALID); 948 } else { 949 /* packet complete */ 950 tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID); 951 } 952 if (need_irq) { 953 tpm_tis_raise_irq(s, locty, TPM_TIS_INT_STS_VALID); 954 } 955 } 956 } 957 break; 958 case TPM_TIS_REG_INTERFACE_ID: 959 if (val & TPM_TIS_IFACE_ID_INT_SEL_LOCK) { 960 for (l = 0; l < TPM_TIS_NUM_LOCALITIES; l++) { 961 s->loc[l].iface_id |= TPM_TIS_IFACE_ID_INT_SEL_LOCK; 962 } 963 } 964 break; 965 } 966 } 967 968 static const MemoryRegionOps tpm_tis_memory_ops = { 969 .read = tpm_tis_mmio_read, 970 .write = tpm_tis_mmio_write, 971 .endianness = DEVICE_LITTLE_ENDIAN, 972 .valid = { 973 .min_access_size = 1, 974 .max_access_size = 4, 975 }, 976 }; 977 978 static int tpm_tis_do_startup_tpm(TPMState *s, size_t buffersize) 979 { 980 return tpm_backend_startup_tpm(s->be_driver, buffersize); 981 } 982 983 /* 984 * Get the TPMVersion of the backend device being used 985 */ 986 static enum TPMVersion tpm_tis_get_tpm_version(TPMIf *ti) 987 { 988 TPMState *s = TPM(ti); 989 990 if (tpm_backend_had_startup_error(s->be_driver)) { 991 return TPM_VERSION_UNSPEC; 992 } 993 994 return tpm_backend_get_tpm_version(s->be_driver); 995 } 996 997 /* 998 * This function is called when the machine starts, resets or due to 999 * S3 resume. 1000 */ 1001 static void tpm_tis_reset(DeviceState *dev) 1002 { 1003 TPMState *s = TPM(dev); 1004 int c; 1005 1006 s->be_tpm_version = tpm_backend_get_tpm_version(s->be_driver); 1007 s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->be_driver), 1008 TPM_TIS_BUFFER_MAX); 1009 1010 tpm_backend_reset(s->be_driver); 1011 1012 s->active_locty = TPM_TIS_NO_LOCALITY; 1013 s->next_locty = TPM_TIS_NO_LOCALITY; 1014 s->aborting_locty = TPM_TIS_NO_LOCALITY; 1015 1016 for (c = 0; c < TPM_TIS_NUM_LOCALITIES; c++) { 1017 s->loc[c].access = TPM_TIS_ACCESS_TPM_REG_VALID_STS; 1018 switch (s->be_tpm_version) { 1019 case TPM_VERSION_UNSPEC: 1020 break; 1021 case TPM_VERSION_1_2: 1022 s->loc[c].sts = TPM_TIS_STS_TPM_FAMILY1_2; 1023 s->loc[c].iface_id = TPM_TIS_IFACE_ID_SUPPORTED_FLAGS1_3; 1024 break; 1025 case TPM_VERSION_2_0: 1026 s->loc[c].sts = TPM_TIS_STS_TPM_FAMILY2_0; 1027 s->loc[c].iface_id = TPM_TIS_IFACE_ID_SUPPORTED_FLAGS2_0; 1028 break; 1029 } 1030 s->loc[c].inte = TPM_TIS_INT_POLARITY_LOW_LEVEL; 1031 s->loc[c].ints = 0; 1032 s->loc[c].state = TPM_TIS_STATE_IDLE; 1033 1034 s->loc[c].w_offset = 0; 1035 s->loc[c].r_offset = 0; 1036 } 1037 1038 tpm_tis_do_startup_tpm(s, s->be_buffer_size); 1039 } 1040 1041 static const VMStateDescription vmstate_tpm_tis = { 1042 .name = "tpm", 1043 .unmigratable = 1, 1044 }; 1045 1046 static Property tpm_tis_properties[] = { 1047 DEFINE_PROP_UINT32("irq", TPMState, irq_num, TPM_TIS_IRQ), 1048 DEFINE_PROP_TPMBE("tpmdev", TPMState, be_driver), 1049 DEFINE_PROP_END_OF_LIST(), 1050 }; 1051 1052 static void tpm_tis_realizefn(DeviceState *dev, Error **errp) 1053 { 1054 TPMState *s = TPM(dev); 1055 1056 if (!tpm_find()) { 1057 error_setg(errp, "at most one TPM device is permitted"); 1058 return; 1059 } 1060 1061 if (!s->be_driver) { 1062 error_setg(errp, "'tpmdev' property is required"); 1063 return; 1064 } 1065 if (s->irq_num > 15) { 1066 error_setg(errp, "IRQ %d is outside valid range of 0 to 15", 1067 s->irq_num); 1068 return; 1069 } 1070 1071 isa_init_irq(&s->busdev, &s->irq, s->irq_num); 1072 1073 memory_region_add_subregion(isa_address_space(ISA_DEVICE(dev)), 1074 TPM_TIS_ADDR_BASE, &s->mmio); 1075 } 1076 1077 static void tpm_tis_initfn(Object *obj) 1078 { 1079 TPMState *s = TPM(obj); 1080 1081 memory_region_init_io(&s->mmio, OBJECT(s), &tpm_tis_memory_ops, 1082 s, "tpm-tis-mmio", 1083 TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT); 1084 } 1085 1086 static void tpm_tis_class_init(ObjectClass *klass, void *data) 1087 { 1088 DeviceClass *dc = DEVICE_CLASS(klass); 1089 TPMIfClass *tc = TPM_IF_CLASS(klass); 1090 1091 dc->realize = tpm_tis_realizefn; 1092 dc->props = tpm_tis_properties; 1093 dc->reset = tpm_tis_reset; 1094 dc->vmsd = &vmstate_tpm_tis; 1095 tc->model = TPM_MODEL_TPM_TIS; 1096 tc->get_version = tpm_tis_get_tpm_version; 1097 tc->request_completed = tpm_tis_request_completed; 1098 } 1099 1100 static const TypeInfo tpm_tis_info = { 1101 .name = TYPE_TPM_TIS, 1102 .parent = TYPE_ISA_DEVICE, 1103 .instance_size = sizeof(TPMState), 1104 .instance_init = tpm_tis_initfn, 1105 .class_init = tpm_tis_class_init, 1106 .interfaces = (InterfaceInfo[]) { 1107 { TYPE_TPM_IF }, 1108 { } 1109 } 1110 }; 1111 1112 static void tpm_tis_register(void) 1113 { 1114 type_register_static(&tpm_tis_info); 1115 } 1116 1117 type_init(tpm_tis_register) 1118