2 * tpm_crb.c - QEMU's TPM CRB interface emulator
4 * Copyright (c) 2018 Red Hat, Inc.
7 * Marc-André Lureau <marcandre.lureau@redhat.com>
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
12 * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface
13 * as defined in TCG PC Client Platform TPM Profile (PTP) Specification
14 * Family “2.0” Level 00 Revision 01.03 v22
17 #include "qemu/osdep.h"
19 #include "qemu/module.h"
20 #include "qapi/error.h"
21 #include "exec/address-spaces.h"
22 #include "hw/qdev-properties.h"
23 #include "hw/pci/pci_ids.h"
24 #include "hw/acpi/tpm.h"
25 #include "migration/vmstate.h"
26 #include "sysemu/tpm_backend.h"
27 #include "sysemu/tpm_util.h"
28 #include "sysemu/reset.h"
32 #include "qom/object.h"
35 DeviceState parent_obj
;
39 uint32_t regs
[TPM_CRB_R_MAX
];
43 size_t be_buffer_size
;
48 typedef struct CRBState CRBState
;
50 DECLARE_INSTANCE_CHECKER(CRBState
, CRB
,
53 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1
54 #define CRB_INTF_VERSION_CRB 0b1
55 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0
56 #define CRB_INTF_CAP_IDLE_FAST 0b0
57 #define CRB_INTF_CAP_XFER_SIZE_64 0b11
58 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0
59 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1
60 #define CRB_INTF_IF_SELECTOR_CRB 0b1
62 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER)
65 CRB_LOC_CTRL_REQUEST_ACCESS
= BIT(0),
66 CRB_LOC_CTRL_RELINQUISH
= BIT(1),
67 CRB_LOC_CTRL_SEIZE
= BIT(2),
68 CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT
= BIT(3),
72 CRB_CTRL_REQ_CMD_READY
= BIT(0),
73 CRB_CTRL_REQ_GO_IDLE
= BIT(1),
77 CRB_START_INVOKE
= BIT(0),
81 CRB_CANCEL_INVOKE
= BIT(0),
84 #define TPM_CRB_NO_LOCALITY 0xff
86 static uint64_t tpm_crb_mmio_read(void *opaque
, hwaddr addr
,
89 CRBState
*s
= CRB(opaque
);
90 void *regs
= (void *)&s
->regs
+ (addr
& ~3);
91 unsigned offset
= addr
& 3;
92 uint32_t val
= *(uint32_t *)regs
>> (8 * offset
);
96 val
|= !tpm_backend_get_tpm_established_flag(s
->tpmbe
);
100 trace_tpm_crb_mmio_read(addr
, size
, val
);
105 static uint8_t tpm_crb_get_active_locty(CRBState
*s
)
107 if (!ARRAY_FIELD_EX32(s
->regs
, CRB_LOC_STATE
, locAssigned
)) {
108 return TPM_CRB_NO_LOCALITY
;
110 return ARRAY_FIELD_EX32(s
->regs
, CRB_LOC_STATE
, activeLocality
);
113 static void tpm_crb_mmio_write(void *opaque
, hwaddr addr
,
114 uint64_t val
, unsigned size
)
116 CRBState
*s
= CRB(opaque
);
117 uint8_t locty
= addr
>> 12;
119 trace_tpm_crb_mmio_write(addr
, size
, val
);
124 case CRB_CTRL_REQ_CMD_READY
:
125 ARRAY_FIELD_DP32(s
->regs
, CRB_CTRL_STS
,
128 case CRB_CTRL_REQ_GO_IDLE
:
129 ARRAY_FIELD_DP32(s
->regs
, CRB_CTRL_STS
,
134 case A_CRB_CTRL_CANCEL
:
135 if (val
== CRB_CANCEL_INVOKE
&&
136 s
->regs
[R_CRB_CTRL_START
] & CRB_START_INVOKE
) {
137 tpm_backend_cancel_cmd(s
->tpmbe
);
140 case A_CRB_CTRL_START
:
141 if (val
== CRB_START_INVOKE
&&
142 !(s
->regs
[R_CRB_CTRL_START
] & CRB_START_INVOKE
) &&
143 tpm_crb_get_active_locty(s
) == locty
) {
144 void *mem
= memory_region_get_ram_ptr(&s
->cmdmem
);
146 s
->regs
[R_CRB_CTRL_START
] |= CRB_START_INVOKE
;
147 s
->cmd
= (TPMBackendCmd
) {
149 .in_len
= MIN(tpm_cmd_get_size(mem
), s
->be_buffer_size
),
151 .out_len
= s
->be_buffer_size
,
154 tpm_backend_deliver_request(s
->tpmbe
, &s
->cmd
);
159 case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT
:
162 case CRB_LOC_CTRL_RELINQUISH
:
163 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STATE
,
165 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STS
,
168 case CRB_LOC_CTRL_REQUEST_ACCESS
:
169 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STS
,
171 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STS
,
173 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STATE
,
181 static const MemoryRegionOps tpm_crb_memory_ops
= {
182 .read
= tpm_crb_mmio_read
,
183 .write
= tpm_crb_mmio_write
,
184 .endianness
= DEVICE_LITTLE_ENDIAN
,
186 .min_access_size
= 1,
187 .max_access_size
= 4,
191 static void tpm_crb_request_completed(TPMIf
*ti
, int ret
)
193 CRBState
*s
= CRB(ti
);
195 s
->regs
[R_CRB_CTRL_START
] &= ~CRB_START_INVOKE
;
197 ARRAY_FIELD_DP32(s
->regs
, CRB_CTRL_STS
,
198 tpmSts
, 1); /* fatal error */
200 memory_region_set_dirty(&s
->cmdmem
, 0, CRB_CTRL_CMD_SIZE
);
203 static enum TPMVersion
tpm_crb_get_version(TPMIf
*ti
)
205 CRBState
*s
= CRB(ti
);
207 return tpm_backend_get_tpm_version(s
->tpmbe
);
210 static int tpm_crb_pre_save(void *opaque
)
212 CRBState
*s
= opaque
;
214 tpm_backend_finish_sync(s
->tpmbe
);
219 static const VMStateDescription vmstate_tpm_crb
= {
221 .pre_save
= tpm_crb_pre_save
,
222 .fields
= (VMStateField
[]) {
223 VMSTATE_UINT32_ARRAY(regs
, CRBState
, TPM_CRB_R_MAX
),
224 VMSTATE_END_OF_LIST(),
228 static Property tpm_crb_properties
[] = {
229 DEFINE_PROP_TPMBE("tpmdev", CRBState
, tpmbe
),
230 DEFINE_PROP_BOOL("ppi", CRBState
, ppi_enabled
, true),
231 DEFINE_PROP_END_OF_LIST(),
234 static void tpm_crb_reset(void *dev
)
236 CRBState
*s
= CRB(dev
);
238 if (s
->ppi_enabled
) {
239 tpm_ppi_reset(&s
->ppi
);
241 tpm_backend_reset(s
->tpmbe
);
243 memset(s
->regs
, 0, sizeof(s
->regs
));
245 ARRAY_FIELD_DP32(s
->regs
, CRB_LOC_STATE
,
247 ARRAY_FIELD_DP32(s
->regs
, CRB_CTRL_STS
,
249 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
250 InterfaceType
, CRB_INTF_TYPE_CRB_ACTIVE
);
251 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
252 InterfaceVersion
, CRB_INTF_VERSION_CRB
);
253 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
254 CapLocality
, CRB_INTF_CAP_LOCALITY_0_ONLY
);
255 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
256 CapCRBIdleBypass
, CRB_INTF_CAP_IDLE_FAST
);
257 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
258 CapDataXferSizeSupport
, CRB_INTF_CAP_XFER_SIZE_64
);
259 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
260 CapFIFO
, CRB_INTF_CAP_FIFO_NOT_SUPPORTED
);
261 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
262 CapCRB
, CRB_INTF_CAP_CRB_SUPPORTED
);
263 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
264 InterfaceSelector
, CRB_INTF_IF_SELECTOR_CRB
);
265 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID
,
267 ARRAY_FIELD_DP32(s
->regs
, CRB_INTF_ID2
,
268 VID
, PCI_VENDOR_ID_IBM
);
270 s
->regs
[R_CRB_CTRL_CMD_SIZE
] = CRB_CTRL_CMD_SIZE
;
271 s
->regs
[R_CRB_CTRL_CMD_LADDR
] = TPM_CRB_ADDR_BASE
+ A_CRB_DATA_BUFFER
;
272 s
->regs
[R_CRB_CTRL_RSP_SIZE
] = CRB_CTRL_CMD_SIZE
;
273 s
->regs
[R_CRB_CTRL_RSP_ADDR
] = TPM_CRB_ADDR_BASE
+ A_CRB_DATA_BUFFER
;
275 s
->be_buffer_size
= MIN(tpm_backend_get_buffer_size(s
->tpmbe
),
278 if (tpm_backend_startup_tpm(s
->tpmbe
, s
->be_buffer_size
) < 0) {
283 static void tpm_crb_realize(DeviceState
*dev
, Error
**errp
)
285 CRBState
*s
= CRB(dev
);
288 error_setg(errp
, "at most one TPM device is permitted");
292 error_setg(errp
, "'tpmdev' property is required");
296 memory_region_init_io(&s
->mmio
, OBJECT(s
), &tpm_crb_memory_ops
, s
,
297 "tpm-crb-mmio", sizeof(s
->regs
));
298 memory_region_init_ram(&s
->cmdmem
, OBJECT(s
),
299 "tpm-crb-cmd", CRB_CTRL_CMD_SIZE
, errp
);
301 memory_region_add_subregion(get_system_memory(),
302 TPM_CRB_ADDR_BASE
, &s
->mmio
);
303 memory_region_add_subregion(get_system_memory(),
304 TPM_CRB_ADDR_BASE
+ sizeof(s
->regs
), &s
->cmdmem
);
306 if (s
->ppi_enabled
) {
307 tpm_ppi_init(&s
->ppi
, get_system_memory(),
308 TPM_PPI_ADDR_BASE
, OBJECT(s
));
311 qemu_register_reset(tpm_crb_reset
, dev
);
314 static void tpm_crb_class_init(ObjectClass
*klass
, void *data
)
316 DeviceClass
*dc
= DEVICE_CLASS(klass
);
317 TPMIfClass
*tc
= TPM_IF_CLASS(klass
);
319 dc
->realize
= tpm_crb_realize
;
320 device_class_set_props(dc
, tpm_crb_properties
);
321 dc
->vmsd
= &vmstate_tpm_crb
;
322 dc
->user_creatable
= true;
323 tc
->model
= TPM_MODEL_TPM_CRB
;
324 tc
->get_version
= tpm_crb_get_version
;
325 tc
->request_completed
= tpm_crb_request_completed
;
327 set_bit(DEVICE_CATEGORY_MISC
, dc
->categories
);
330 static const TypeInfo tpm_crb_info
= {
331 .name
= TYPE_TPM_CRB
,
332 /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */
333 .parent
= TYPE_DEVICE
,
334 .instance_size
= sizeof(CRBState
),
335 .class_init
= tpm_crb_class_init
,
336 .interfaces
= (InterfaceInfo
[]) {
342 static void tpm_crb_register(void)
344 type_register_static(&tpm_crb_info
);
347 type_init(tpm_crb_register
)