1 /* 2 * tpm_crb.c - QEMU's TPM CRB interface emulator 3 * 4 * Copyright (c) 2018 Red Hat, Inc. 5 * 6 * Authors: 7 * Marc-André Lureau <marcandre.lureau@redhat.com> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface 13 * as defined in TCG PC Client Platform TPM Profile (PTP) Specification 14 * Family “2.0” Level 00 Revision 01.03 v22 15 */ 16 17 #include "qemu/osdep.h" 18 19 #include "qemu-common.h" 20 #include "qapi/error.h" 21 #include "exec/address-spaces.h" 22 23 #include "hw/qdev-core.h" 24 #include "hw/qdev-properties.h" 25 #include "hw/pci/pci_ids.h" 26 #include "hw/acpi/tpm.h" 27 #include "migration/vmstate.h" 28 #include "sysemu/tpm_backend.h" 29 #include "sysemu/reset.h" 30 #include "tpm_int.h" 31 #include "tpm_util.h" 32 33 typedef struct CRBState { 34 DeviceState parent_obj; 35 36 TPMBackend *tpmbe; 37 TPMBackendCmd cmd; 38 uint32_t regs[TPM_CRB_R_MAX]; 39 MemoryRegion mmio; 40 MemoryRegion cmdmem; 41 42 size_t be_buffer_size; 43 } CRBState; 44 45 #define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB) 46 47 #define DEBUG_CRB 0 48 49 #define DPRINTF(fmt, ...) do { \ 50 if (DEBUG_CRB) { \ 51 printf(fmt, ## __VA_ARGS__); \ 52 } \ 53 } while (0) 54 55 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1 56 #define CRB_INTF_VERSION_CRB 0b1 57 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0 58 #define CRB_INTF_CAP_IDLE_FAST 0b0 59 #define CRB_INTF_CAP_XFER_SIZE_64 0b11 60 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0 61 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1 62 #define CRB_INTF_IF_SELECTOR_CRB 0b1 63 64 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER) 65 66 enum crb_loc_ctrl { 67 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0), 68 CRB_LOC_CTRL_RELINQUISH = BIT(1), 69 CRB_LOC_CTRL_SEIZE = BIT(2), 70 CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3), 71 }; 72 73 enum crb_ctrl_req { 74 CRB_CTRL_REQ_CMD_READY = BIT(0), 75 CRB_CTRL_REQ_GO_IDLE = BIT(1), 76 }; 77 78 enum crb_start { 79 CRB_START_INVOKE = BIT(0), 80 }; 81 82 enum crb_cancel { 83 CRB_CANCEL_INVOKE = BIT(0), 84 }; 85 86 static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr, 87 unsigned size) 88 { 89 CRBState *s = CRB(opaque); 90 void *regs = (void *)&s->regs + (addr & ~3); 91 unsigned offset = addr & 3; 92 uint32_t val = *(uint32_t *)regs >> (8 * offset); 93 94 DPRINTF("CRB read 0x" TARGET_FMT_plx " len:%u val: 0x%" PRIx32 "\n", 95 addr, size, val); 96 return val; 97 } 98 99 static void tpm_crb_mmio_write(void *opaque, hwaddr addr, 100 uint64_t val, unsigned size) 101 { 102 CRBState *s = CRB(opaque); 103 DPRINTF("CRB write 0x" TARGET_FMT_plx " len:%u val: 0x%" PRIx64 "\n", 104 addr, size, val); 105 106 switch (addr) { 107 case A_CRB_CTRL_REQ: 108 switch (val) { 109 case CRB_CTRL_REQ_CMD_READY: 110 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 111 tpmIdle, 0); 112 break; 113 case CRB_CTRL_REQ_GO_IDLE: 114 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 115 tpmIdle, 1); 116 break; 117 } 118 break; 119 case A_CRB_CTRL_CANCEL: 120 if (val == CRB_CANCEL_INVOKE && 121 s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) { 122 tpm_backend_cancel_cmd(s->tpmbe); 123 } 124 break; 125 case A_CRB_CTRL_START: 126 if (val == CRB_START_INVOKE && 127 !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE)) { 128 void *mem = memory_region_get_ram_ptr(&s->cmdmem); 129 130 s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE; 131 s->cmd = (TPMBackendCmd) { 132 .in = mem, 133 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size), 134 .out = mem, 135 .out_len = s->be_buffer_size, 136 }; 137 138 tpm_backend_deliver_request(s->tpmbe, &s->cmd); 139 } 140 break; 141 case A_CRB_LOC_CTRL: 142 switch (val) { 143 case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT: 144 /* not loc 3 or 4 */ 145 break; 146 case CRB_LOC_CTRL_RELINQUISH: 147 break; 148 case CRB_LOC_CTRL_REQUEST_ACCESS: 149 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 150 Granted, 1); 151 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 152 beenSeized, 0); 153 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 154 locAssigned, 1); 155 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 156 tpmRegValidSts, 1); 157 break; 158 } 159 break; 160 } 161 } 162 163 static const MemoryRegionOps tpm_crb_memory_ops = { 164 .read = tpm_crb_mmio_read, 165 .write = tpm_crb_mmio_write, 166 .endianness = DEVICE_LITTLE_ENDIAN, 167 .valid = { 168 .min_access_size = 1, 169 .max_access_size = 4, 170 }, 171 }; 172 173 static void tpm_crb_request_completed(TPMIf *ti, int ret) 174 { 175 CRBState *s = CRB(ti); 176 177 s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE; 178 if (ret != 0) { 179 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 180 tpmSts, 1); /* fatal error */ 181 } 182 } 183 184 static enum TPMVersion tpm_crb_get_version(TPMIf *ti) 185 { 186 CRBState *s = CRB(ti); 187 188 return tpm_backend_get_tpm_version(s->tpmbe); 189 } 190 191 static int tpm_crb_pre_save(void *opaque) 192 { 193 CRBState *s = opaque; 194 195 tpm_backend_finish_sync(s->tpmbe); 196 197 return 0; 198 } 199 200 static const VMStateDescription vmstate_tpm_crb = { 201 .name = "tpm-crb", 202 .pre_save = tpm_crb_pre_save, 203 .fields = (VMStateField[]) { 204 VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX), 205 VMSTATE_END_OF_LIST(), 206 } 207 }; 208 209 static Property tpm_crb_properties[] = { 210 DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe), 211 DEFINE_PROP_END_OF_LIST(), 212 }; 213 214 static void tpm_crb_reset(void *dev) 215 { 216 CRBState *s = CRB(dev); 217 218 tpm_backend_reset(s->tpmbe); 219 220 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 221 InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE); 222 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 223 InterfaceVersion, CRB_INTF_VERSION_CRB); 224 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 225 CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY); 226 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 227 CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST); 228 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 229 CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64); 230 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 231 CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED); 232 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 233 CapCRB, CRB_INTF_CAP_CRB_SUPPORTED); 234 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 235 InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB); 236 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 237 RID, 0b0000); 238 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2, 239 VID, PCI_VENDOR_ID_IBM); 240 241 s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE; 242 s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER; 243 s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE; 244 s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER; 245 246 s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe), 247 CRB_CTRL_CMD_SIZE); 248 249 tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size); 250 } 251 252 static void tpm_crb_realize(DeviceState *dev, Error **errp) 253 { 254 CRBState *s = CRB(dev); 255 256 if (!tpm_find()) { 257 error_setg(errp, "at most one TPM device is permitted"); 258 return; 259 } 260 if (!s->tpmbe) { 261 error_setg(errp, "'tpmdev' property is required"); 262 return; 263 } 264 265 memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s, 266 "tpm-crb-mmio", sizeof(s->regs)); 267 memory_region_init_ram(&s->cmdmem, OBJECT(s), 268 "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp); 269 270 memory_region_add_subregion(get_system_memory(), 271 TPM_CRB_ADDR_BASE, &s->mmio); 272 memory_region_add_subregion(get_system_memory(), 273 TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem); 274 275 qemu_register_reset(tpm_crb_reset, dev); 276 } 277 278 static void tpm_crb_class_init(ObjectClass *klass, void *data) 279 { 280 DeviceClass *dc = DEVICE_CLASS(klass); 281 TPMIfClass *tc = TPM_IF_CLASS(klass); 282 283 dc->realize = tpm_crb_realize; 284 dc->props = tpm_crb_properties; 285 dc->vmsd = &vmstate_tpm_crb; 286 dc->user_creatable = true; 287 tc->model = TPM_MODEL_TPM_CRB; 288 tc->get_version = tpm_crb_get_version; 289 tc->request_completed = tpm_crb_request_completed; 290 291 set_bit(DEVICE_CATEGORY_MISC, dc->categories); 292 } 293 294 static const TypeInfo tpm_crb_info = { 295 .name = TYPE_TPM_CRB, 296 /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */ 297 .parent = TYPE_DEVICE, 298 .instance_size = sizeof(CRBState), 299 .class_init = tpm_crb_class_init, 300 .interfaces = (InterfaceInfo[]) { 301 { TYPE_TPM_IF }, 302 { } 303 } 304 }; 305 306 static void tpm_crb_register(void) 307 { 308 type_register_static(&tpm_crb_info); 309 } 310 311 type_init(tpm_crb_register) 312