1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#include "qemu/osdep.h"
18
19#include "qemu/module.h"
20#include "qapi/error.h"
21#include "exec/address-spaces.h"
22#include "hw/qdev-properties.h"
23#include "hw/pci/pci_ids.h"
24#include "hw/acpi/tpm.h"
25#include "migration/vmstate.h"
26#include "sysemu/tpm_backend.h"
27#include "sysemu/reset.h"
28#include "tpm_int.h"
29#include "tpm_util.h"
30#include "tpm_ppi.h"
31#include "trace.h"
32
33typedef struct CRBState {
34 DeviceState parent_obj;
35
36 TPMBackend *tpmbe;
37 TPMBackendCmd cmd;
38 uint32_t regs[TPM_CRB_R_MAX];
39 MemoryRegion mmio;
40 MemoryRegion cmdmem;
41
42 size_t be_buffer_size;
43
44 bool ppi_enabled;
45 TPMPPI ppi;
46} CRBState;
47
48#define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB)
49
50#define CRB_INTF_TYPE_CRB_ACTIVE 0b1
51#define CRB_INTF_VERSION_CRB 0b1
52#define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0
53#define CRB_INTF_CAP_IDLE_FAST 0b0
54#define CRB_INTF_CAP_XFER_SIZE_64 0b11
55#define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0
56#define CRB_INTF_CAP_CRB_SUPPORTED 0b1
57#define CRB_INTF_IF_SELECTOR_CRB 0b1
58
59#define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER)
60
61enum crb_loc_ctrl {
62 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0),
63 CRB_LOC_CTRL_RELINQUISH = BIT(1),
64 CRB_LOC_CTRL_SEIZE = BIT(2),
65 CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3),
66};
67
68enum crb_ctrl_req {
69 CRB_CTRL_REQ_CMD_READY = BIT(0),
70 CRB_CTRL_REQ_GO_IDLE = BIT(1),
71};
72
73enum crb_start {
74 CRB_START_INVOKE = BIT(0),
75};
76
77enum crb_cancel {
78 CRB_CANCEL_INVOKE = BIT(0),
79};
80
81#define TPM_CRB_NO_LOCALITY 0xff
82
83static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr,
84 unsigned size)
85{
86 CRBState *s = CRB(opaque);
87 void *regs = (void *)&s->regs + (addr & ~3);
88 unsigned offset = addr & 3;
89 uint32_t val = *(uint32_t *)regs >> (8 * offset);
90
91 switch (addr) {
92 case A_CRB_LOC_STATE:
93 val |= !tpm_backend_get_tpm_established_flag(s->tpmbe);
94 break;
95 }
96
97 trace_tpm_crb_mmio_read(addr, size, val);
98
99 return val;
100}
101
102static uint8_t tpm_crb_get_active_locty(CRBState *s)
103{
104 if (!ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, locAssigned)) {
105 return TPM_CRB_NO_LOCALITY;
106 }
107 return ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, activeLocality);
108}
109
110static void tpm_crb_mmio_write(void *opaque, hwaddr addr,
111 uint64_t val, unsigned size)
112{
113 CRBState *s = CRB(opaque);
114 uint8_t locty = addr >> 12;
115
116 trace_tpm_crb_mmio_write(addr, size, val);
117
118 switch (addr) {
119 case A_CRB_CTRL_REQ:
120 switch (val) {
121 case CRB_CTRL_REQ_CMD_READY:
122 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
123 tpmIdle, 0);
124 break;
125 case CRB_CTRL_REQ_GO_IDLE:
126 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
127 tpmIdle, 1);
128 break;
129 }
130 break;
131 case A_CRB_CTRL_CANCEL:
132 if (val == CRB_CANCEL_INVOKE &&
133 s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) {
134 tpm_backend_cancel_cmd(s->tpmbe);
135 }
136 break;
137 case A_CRB_CTRL_START:
138 if (val == CRB_START_INVOKE &&
139 !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) &&
140 tpm_crb_get_active_locty(s) == locty) {
141 void *mem = memory_region_get_ram_ptr(&s->cmdmem);
142
143 s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE;
144 s->cmd = (TPMBackendCmd) {
145 .in = mem,
146 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size),
147 .out = mem,
148 .out_len = s->be_buffer_size,
149 };
150
151 tpm_backend_deliver_request(s->tpmbe, &s->cmd);
152 }
153 break;
154 case A_CRB_LOC_CTRL:
155 switch (val) {
156 case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT:
157
158 break;
159 case CRB_LOC_CTRL_RELINQUISH:
160 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
161 locAssigned, 0);
162 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
163 Granted, 0);
164 break;
165 case CRB_LOC_CTRL_REQUEST_ACCESS:
166 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
167 Granted, 1);
168 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
169 beenSeized, 0);
170 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
171 locAssigned, 1);
172 break;
173 }
174 break;
175 }
176}
177
178static const MemoryRegionOps tpm_crb_memory_ops = {
179 .read = tpm_crb_mmio_read,
180 .write = tpm_crb_mmio_write,
181 .endianness = DEVICE_LITTLE_ENDIAN,
182 .valid = {
183 .min_access_size = 1,
184 .max_access_size = 4,
185 },
186};
187
188static void tpm_crb_request_completed(TPMIf *ti, int ret)
189{
190 CRBState *s = CRB(ti);
191
192 s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE;
193 if (ret != 0) {
194 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
195 tpmSts, 1);
196 }
197}
198
199static enum TPMVersion tpm_crb_get_version(TPMIf *ti)
200{
201 CRBState *s = CRB(ti);
202
203 return tpm_backend_get_tpm_version(s->tpmbe);
204}
205
206static int tpm_crb_pre_save(void *opaque)
207{
208 CRBState *s = opaque;
209
210 tpm_backend_finish_sync(s->tpmbe);
211
212 return 0;
213}
214
215static const VMStateDescription vmstate_tpm_crb = {
216 .name = "tpm-crb",
217 .pre_save = tpm_crb_pre_save,
218 .fields = (VMStateField[]) {
219 VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX),
220 VMSTATE_END_OF_LIST(),
221 }
222};
223
224static Property tpm_crb_properties[] = {
225 DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe),
226 DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true),
227 DEFINE_PROP_END_OF_LIST(),
228};
229
230static void tpm_crb_reset(void *dev)
231{
232 CRBState *s = CRB(dev);
233
234 if (s->ppi_enabled) {
235 tpm_ppi_reset(&s->ppi);
236 }
237 tpm_backend_reset(s->tpmbe);
238
239 memset(s->regs, 0, sizeof(s->regs));
240
241 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
242 tpmRegValidSts, 1);
243 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
244 tpmIdle, 1);
245 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
246 InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE);
247 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
248 InterfaceVersion, CRB_INTF_VERSION_CRB);
249 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
250 CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY);
251 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
252 CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST);
253 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
254 CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64);
255 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
256 CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED);
257 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
258 CapCRB, CRB_INTF_CAP_CRB_SUPPORTED);
259 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
260 InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB);
261 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
262 RID, 0b0000);
263 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2,
264 VID, PCI_VENDOR_ID_IBM);
265
266 s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE;
267 s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
268 s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE;
269 s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
270
271 s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe),
272 CRB_CTRL_CMD_SIZE);
273
274 if (tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size) < 0) {
275 exit(1);
276 }
277}
278
279static void tpm_crb_realize(DeviceState *dev, Error **errp)
280{
281 CRBState *s = CRB(dev);
282
283 if (!tpm_find()) {
284 error_setg(errp, "at most one TPM device is permitted");
285 return;
286 }
287 if (!s->tpmbe) {
288 error_setg(errp, "'tpmdev' property is required");
289 return;
290 }
291
292 memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s,
293 "tpm-crb-mmio", sizeof(s->regs));
294 memory_region_init_ram(&s->cmdmem, OBJECT(s),
295 "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp);
296
297 memory_region_add_subregion(get_system_memory(),
298 TPM_CRB_ADDR_BASE, &s->mmio);
299 memory_region_add_subregion(get_system_memory(),
300 TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem);
301
302 if (s->ppi_enabled) {
303 tpm_ppi_init(&s->ppi, get_system_memory(),
304 TPM_PPI_ADDR_BASE, OBJECT(s));
305 }
306
307 qemu_register_reset(tpm_crb_reset, dev);
308}
309
310static void tpm_crb_class_init(ObjectClass *klass, void *data)
311{
312 DeviceClass *dc = DEVICE_CLASS(klass);
313 TPMIfClass *tc = TPM_IF_CLASS(klass);
314
315 dc->realize = tpm_crb_realize;
316 dc->props = tpm_crb_properties;
317 dc->vmsd = &vmstate_tpm_crb;
318 dc->user_creatable = true;
319 tc->model = TPM_MODEL_TPM_CRB;
320 tc->get_version = tpm_crb_get_version;
321 tc->request_completed = tpm_crb_request_completed;
322
323 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
324}
325
326static const TypeInfo tpm_crb_info = {
327 .name = TYPE_TPM_CRB,
328
329 .parent = TYPE_DEVICE,
330 .instance_size = sizeof(CRBState),
331 .class_init = tpm_crb_class_init,
332 .interfaces = (InterfaceInfo[]) {
333 { TYPE_TPM_IF },
334 { }
335 }
336};
337
338static void tpm_crb_register(void)
339{
340 type_register_static(&tpm_crb_info);
341}
342
343type_init(tpm_crb_register)
344
