Kevin Bowling 6362e5068c tpm: Validate firmware interrupt routes and fall back cleanly ...

A host IRQ resource is not necessarily an LPC SIRQ selector.  Let the
frontend configure the route: ACPI uses the allocated _CRS interrupt and
_SRS when present, preserving the firmware selector, while ISA supplies a
separate, range-checked SIRQ.  Match trigger and polarity to the host route
and TPM capabilities, including opaque INTRNG resource mappings.
Pass the firmware descriptor unchanged to _SRS; apply the x86 ISA polarity
override only when computing the TPM mode.  ISA chips without rising-edge
support now poll instead of substituting a level mode for the host route.

For both FIFO drivers, require a complete GetRandom transport response and
a fresh DATA_AVAIL interrupt before selecting interrupt waits.  Perform
the test with polling before publishing the device, and repeat it after
resume.  During cold boot, defer the test and publication to an interrupt
configuration hook so the IRQ grace wait can sleep and the handler can run.
Drain the hook before teardown; failed deferred initialization remains
unpublished and can be detached safely.  Missing or failed routes release
the handler and IRQ resource;
TPM 1.2 handler-setup failure now also falls back to polling.

Use monotonic deadlines for TPM 1.2 locality, status and burst polling.
Keep lifecycle locality waits uninterruptible, propagate command signal
errors, and terminate transfers when the burst wait expires instead of
retrying a zero burst indefinitely.  Check VALID with the requested status
bits and retain bounded polling response retries.  Interrupt waits retain
their original single-timeout budget and error return.

Arm only DATA_AVAIL before GO.  Mask delivery on the first interrupt and
before relinquishing locality, preventing idle and repeated-source storms.
Bound interrupt sleeps so lost delivery can recover the current command
through polling.  Defer unexpected-source cleanup to a task that can
acquire locality, and drain it before destroying driver locks.  Preserve
an unread TPM 1.2 response when quiescing an already owned locality.

If the ithread cannot mask the TPM, yield for a tick with the host source
masked so a level storm cannot starve the command owner or cleanup worker.
Register INTR_SLEEPABLE | INTR_EXCL for both drivers, and reject firmware
shared routes before installing a handler.  Such routes now poll: FreeBSD
does not allow sleepable shared handlers.  Drain maskable events during
firmware programming without letting them validate or reject the IRQ test.

Retain the initial hardware-quiesce guarantee, including after _SRS:
initialization fails when delivery cannot be disabled, and a later unrecoverable
quiesce failure suspends command access.  Known TPM 1.2 NOINTS quirks and
the TPM 2.0 polling hint remain effective.  Frontends without an explicit
route method use polling.

Tested by:	jrm (tpm 1.2 tis)
MFC after:	2 weeks
Sponsored by:	BBOX.io
Differential Revision:	https://reviews.freebsd.org/D59657

2026-10-30 15:01:53 -07:00

..

Makefile

tpm: Validate firmware interrupt routes and fall back cleanly

2026-10-30 15:01:53 -07:00