2 * tpm_crb.c - QEMU's TPM CRB interface emulator
4 * Copyright (c) 2018 Red Hat, Inc.
7 * Marc-André Lureau <marcandre.lureau@redhat.com>
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
12 * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface
13 * as defined in TCG PC Client Platform TPM Profile (PTP) Specification
14 * Family “2.0” Level 00 Revision 01.03 v22
17 #include "qemu/osdep.h"
19 #include "qemu-common.h"
20 #include "qapi/error.h"
21 #include "exec/address-spaces.h"
23 #include "hw/qdev-core.h"
24 #include "hw/qdev-properties.h"
25 #include "hw/pci/pci_ids.h"
26 #include "hw/acpi/tpm.h"
27 #include "migration/vmstate.h"
28 #include "sysemu/tpm_backend.h"
29 #include "sysemu/reset.h"
34 typedef struct CRBState
{
35 DeviceState parent_obj
;
39 uint32_t regs
[TPM_CRB_R_MAX
];
43 size_t be_buffer_size
;
46 #define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB)
48 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1
49 #define CRB_INTF_VERSION_CRB 0b1
50 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0
51 #define CRB_INTF_CAP_IDLE_FAST 0b0
52 #define CRB_INTF_CAP_XFER_SIZE_64 0b11
53 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0
54 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1
55 #define CRB_INTF_IF_SELECTOR_CRB 0b1
57 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER)
60 CRB_LOC_CTRL_REQUEST_ACCESS
= BIT(0),
61 CRB_LOC_CTRL_RELINQUISH
= BIT(1),
62 CRB_LOC_CTRL_SEIZE
= BIT(2),
63 CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT
= BIT(3),
67 CRB_CTRL_REQ_CMD_READY
= BIT(0),
68 CRB_CTRL_REQ_GO_IDLE
= BIT(1),
72 CRB_START_INVOKE
= BIT(0),
76 CRB_CANCEL_INVOKE
= BIT(0),
79 static uint64_t tpm_crb_mmio_read(void *opaque
, hwaddr addr
,
82 CRBState
*s
= CRB(opaque
);
83 void *regs
= (void *)&s
->regs
+ (addr
& ~3);
84 unsigned offset
= addr
& 3;
85 uint32_t val
= *(uint32_t *)regs
>> (8 * offset
);
87 trace_tpm_crb_mmio_read(addr
, size
, val
);
92 static void tpm_crb_mmio_write(void *opaque
, hwaddr addr
,
93 uint64_t val
, unsigned size
)
95 CRBState
*s
= CRB(opaque
);
97 trace_tpm_crb_mmio_write(addr
, size
, val
);
102 case CRB_CTRL_REQ_CMD_READY
:
103 ARRAY_FIELD_DP32(s
->regs
, CRB_CTRL_STS
,
106 case CRB_CTRL_REQ_GO_IDLE
:
107 ARRAY_FIELD_DP32(s
->regs
, CRB_CTRL_STS
,
112 case A_CRB_CTRL_CANCEL
:
113 if (val
== CRB_CANCEL_INVOKE
&&
114 s
->regs
[R_CRB_CTRL_START
] & CRB_START_INVOKE
) {
115 tpm_backend_cancel_cmd(s
->tpmbe
);
118 case A_CRB_CTRL_START
:
119 if (val
== CRB_START_INVOKE
&&
120 !(s
->regs
[R_CRB_CTRL_START
] & CRB_START_INVOKE
)) {
121 void *mem
= memory_region_get_ram_ptr(&s
->cmdmem
);
123 s
->regs
[R_CRB_CTRL_START
] |= CRB_START_INVOKE
;
124 s
->cmd
= (TPMBackendCmd
) {
126 .in_len
= MIN(tpm_cmd_get_size(mem
), s
->be_buffer_size
),
128 .out_len
= s
->be_buffer_size
,
131 tpm_backend_deliver_request(s
->tpmbe
, &s
->cmd
);
136 case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT
:
139 case CRB_LOC_CTRL_RELINQUISH
:
141 case CRB_LOC_CTRL_REQUEST_ACCESS
:
142 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STS
,
144 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STS
,
146 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STATE
,
148 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STATE
,
156 static const MemoryRegionOps tpm_crb_memory_ops
= {
157 .read
= tpm_crb_mmio_read
,
158 .write
= tpm_crb_mmio_write
,
159 .endianness
= DEVICE_LITTLE_ENDIAN
,
161 .min_access_size
= 1,
162 .max_access_size
= 4,
166 static void tpm_crb_request_completed(TPMIf
*ti
, int ret
)
168 CRBState
*s
= CRB(ti
);
170 s
->regs
[R_CRB_CTRL_START
] &= ~CRB_START_INVOKE
;
172 ARRAY_FIELD_DP32(s
->regs
, CRB_CTRL_STS
,
173 tpmSts
, 1); /* fatal error */
177 static enum TPMVersion
tpm_crb_get_version(TPMIf
*ti
)
179 CRBState
*s
= CRB(ti
);
181 return tpm_backend_get_tpm_version(s
->tpmbe
);
184 static int tpm_crb_pre_save(void *opaque
)
186 CRBState
*s
= opaque
;
188 tpm_backend_finish_sync(s
->tpmbe
);
193 static const VMStateDescription vmstate_tpm_crb
= {
195 .pre_save
= tpm_crb_pre_save
,
196 .fields
= (VMStateField
[]) {
197 VMSTATE_UINT32_ARRAY(regs
, CRBState
, TPM_CRB_R_MAX
),
198 VMSTATE_END_OF_LIST(),
202 static Property tpm_crb_properties
[] = {
203 DEFINE_PROP_TPMBE("tpmdev", CRBState
, tpmbe
),
204 DEFINE_PROP_END_OF_LIST(),
207 static void tpm_crb_reset(void *dev
)
209 CRBState
*s
= CRB(dev
);
211 tpm_backend_reset(s
->tpmbe
);
213 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
214 InterfaceType
, CRB_INTF_TYPE_CRB_ACTIVE
);
215 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
216 InterfaceVersion
, CRB_INTF_VERSION_CRB
);
217 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
218 CapLocality
, CRB_INTF_CAP_LOCALITY_0_ONLY
);
219 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
220 CapCRBIdleBypass
, CRB_INTF_CAP_IDLE_FAST
);
221 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
222 CapDataXferSizeSupport
, CRB_INTF_CAP_XFER_SIZE_64
);
223 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
224 CapFIFO
, CRB_INTF_CAP_FIFO_NOT_SUPPORTED
);
225 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
226 CapCRB
, CRB_INTF_CAP_CRB_SUPPORTED
);
227 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
228 InterfaceSelector
, CRB_INTF_IF_SELECTOR_CRB
);
229 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
231 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID2
,
232 VID
, PCI_VENDOR_ID_IBM
);
234 s
->regs
[R_CRB_CTRL_CMD_SIZE
] = CRB_CTRL_CMD_SIZE
;
235 s
->regs
[R_CRB_CTRL_CMD_LADDR
] = TPM_CRB_ADDR_BASE
+ A_CRB_DATA_BUFFER
;
236 s
->regs
[R_CRB_CTRL_RSP_SIZE
] = CRB_CTRL_CMD_SIZE
;
237 s
->regs
[R_CRB_CTRL_RSP_ADDR
] = TPM_CRB_ADDR_BASE
+ A_CRB_DATA_BUFFER
;
239 s
->be_buffer_size
= MIN(tpm_backend_get_buffer_size(s
->tpmbe
),
242 tpm_backend_startup_tpm(s
->tpmbe
, s
->be_buffer_size
);
245 static void tpm_crb_realize(DeviceState
*dev
, Error
**errp
)
247 CRBState
*s
= CRB(dev
);
250 error_setg(errp
, "at most one TPM device is permitted");
254 error_setg(errp
, "'tpmdev' property is required");
258 memory_region_init_io(&s
->mmio
, OBJECT(s
), &tpm_crb_memory_ops
, s
,
259 "tpm-crb-mmio", sizeof(s
->regs
));
260 memory_region_init_ram(&s
->cmdmem
, OBJECT(s
),
261 "tpm-crb-cmd", CRB_CTRL_CMD_SIZE
, errp
);
263 memory_region_add_subregion(get_system_memory(),
264 TPM_CRB_ADDR_BASE
, &s
->mmio
);
265 memory_region_add_subregion(get_system_memory(),
266 TPM_CRB_ADDR_BASE
+ sizeof(s
->regs
), &s
->cmdmem
);
268 qemu_register_reset(tpm_crb_reset
, dev
);
271 static void tpm_crb_class_init(ObjectClass
*klass
, void *data
)
273 DeviceClass
*dc
= DEVICE_CLASS(klass
);
274 TPMIfClass
*tc
= TPM_IF_CLASS(klass
);
276 dc
->realize
= tpm_crb_realize
;
277 dc
->props
= tpm_crb_properties
;
278 dc
->vmsd
= &vmstate_tpm_crb
;
279 dc
->user_creatable
= true;
280 tc
->model
= TPM_MODEL_TPM_CRB
;
281 tc
->get_version
= tpm_crb_get_version
;
282 tc
->request_completed
= tpm_crb_request_completed
;
284 set_bit(DEVICE_CATEGORY_MISC
, dc
->categories
);
287 static const TypeInfo tpm_crb_info
= {
288 .name
= TYPE_TPM_CRB
,
289 /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */
290 .parent
= TYPE_DEVICE
,
291 .instance_size
= sizeof(CRBState
),
292 .class_init
= tpm_crb_class_init
,
293 .interfaces
= (InterfaceInfo
[]) {
299 static void tpm_crb_register(void)
301 type_register_static(&tpm_crb_info
);
304 type_init(tpm_crb_register
)