1 /* 2 * tpm_crb.c - QEMU's TPM CRB interface emulator 3 * 4 * Copyright (c) 2018 Red Hat, Inc. 5 * 6 * Authors: 7 * Marc-André Lureau <marcandre.lureau@redhat.com> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface 13 * as defined in TCG PC Client Platform TPM Profile (PTP) Specification 14 * Family “2.0” Level 00 Revision 01.03 v22 15 */ 16 17 #include "qemu/osdep.h" 18 19 #include "qemu/module.h" 20 #include "qapi/error.h" 21 #include "exec/address-spaces.h" 22 #include "hw/qdev-properties.h" 23 #include "hw/pci/pci_ids.h" 24 #include "hw/acpi/tpm.h" 25 #include "migration/vmstate.h" 26 #include "sysemu/tpm_backend.h" 27 #include "sysemu/tpm_util.h" 28 #include "sysemu/reset.h" 29 #include "tpm_prop.h" 30 #include "tpm_ppi.h" 31 #include "trace.h" 32 #include "qom/object.h" 33 34 struct CRBState { 35 DeviceState parent_obj; 36 37 TPMBackend *tpmbe; 38 TPMBackendCmd cmd; 39 uint32_t regs[TPM_CRB_R_MAX]; 40 MemoryRegion mmio; 41 MemoryRegion cmdmem; 42 43 size_t be_buffer_size; 44 45 bool ppi_enabled; 46 TPMPPI ppi; 47 }; 48 typedef struct CRBState CRBState; 49 50 DECLARE_INSTANCE_CHECKER(CRBState, CRB, 51 TYPE_TPM_CRB) 52 53 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1 54 #define CRB_INTF_VERSION_CRB 0b1 55 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0 56 #define CRB_INTF_CAP_IDLE_FAST 0b0 57 #define CRB_INTF_CAP_XFER_SIZE_64 0b11 58 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0 59 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1 60 #define CRB_INTF_IF_SELECTOR_CRB 0b1 61 62 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER) 63 64 enum crb_loc_ctrl { 65 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0), 66 CRB_LOC_CTRL_RELINQUISH = BIT(1), 67 CRB_LOC_CTRL_SEIZE = BIT(2), 68 CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3), 69 }; 70 71 enum crb_ctrl_req { 72 CRB_CTRL_REQ_CMD_READY = BIT(0), 73 CRB_CTRL_REQ_GO_IDLE = BIT(1), 74 }; 75 76 enum crb_start { 77 CRB_START_INVOKE = BIT(0), 78 }; 79 80 enum crb_cancel { 81 CRB_CANCEL_INVOKE = BIT(0), 82 }; 83 84 #define TPM_CRB_NO_LOCALITY 0xff 85 86 static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr, 87 unsigned size) 88 { 89 CRBState *s = CRB(opaque); 90 void *regs = (void *)&s->regs + (addr & ~3); 91 unsigned offset = addr & 3; 92 uint32_t val = *(uint32_t *)regs >> (8 * offset); 93 94 switch (addr) { 95 case A_CRB_LOC_STATE: 96 val |= !tpm_backend_get_tpm_established_flag(s->tpmbe); 97 break; 98 } 99 100 trace_tpm_crb_mmio_read(addr, size, val); 101 102 return val; 103 } 104 105 static uint8_t tpm_crb_get_active_locty(CRBState *s) 106 { 107 if (!ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, locAssigned)) { 108 return TPM_CRB_NO_LOCALITY; 109 } 110 return ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, activeLocality); 111 } 112 113 static void tpm_crb_mmio_write(void *opaque, hwaddr addr, 114 uint64_t val, unsigned size) 115 { 116 CRBState *s = CRB(opaque); 117 uint8_t locty = addr >> 12; 118 119 trace_tpm_crb_mmio_write(addr, size, val); 120 121 switch (addr) { 122 case A_CRB_CTRL_REQ: 123 switch (val) { 124 case CRB_CTRL_REQ_CMD_READY: 125 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 126 tpmIdle, 0); 127 break; 128 case CRB_CTRL_REQ_GO_IDLE: 129 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 130 tpmIdle, 1); 131 break; 132 } 133 break; 134 case A_CRB_CTRL_CANCEL: 135 if (val == CRB_CANCEL_INVOKE && 136 s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) { 137 tpm_backend_cancel_cmd(s->tpmbe); 138 } 139 break; 140 case A_CRB_CTRL_START: 141 if (val == CRB_START_INVOKE && 142 !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) && 143 tpm_crb_get_active_locty(s) == locty) { 144 void *mem = memory_region_get_ram_ptr(&s->cmdmem); 145 146 s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE; 147 s->cmd = (TPMBackendCmd) { 148 .in = mem, 149 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size), 150 .out = mem, 151 .out_len = s->be_buffer_size, 152 }; 153 154 tpm_backend_deliver_request(s->tpmbe, &s->cmd); 155 } 156 break; 157 case A_CRB_LOC_CTRL: 158 switch (val) { 159 case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT: 160 /* not loc 3 or 4 */ 161 break; 162 case CRB_LOC_CTRL_RELINQUISH: 163 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 164 locAssigned, 0); 165 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 166 Granted, 0); 167 break; 168 case CRB_LOC_CTRL_REQUEST_ACCESS: 169 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 170 Granted, 1); 171 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 172 beenSeized, 0); 173 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 174 locAssigned, 1); 175 break; 176 } 177 break; 178 } 179 } 180 181 static const MemoryRegionOps tpm_crb_memory_ops = { 182 .read = tpm_crb_mmio_read, 183 .write = tpm_crb_mmio_write, 184 .endianness = DEVICE_LITTLE_ENDIAN, 185 .valid = { 186 .min_access_size = 1, 187 .max_access_size = 4, 188 }, 189 }; 190 191 static void tpm_crb_request_completed(TPMIf *ti, int ret) 192 { 193 CRBState *s = CRB(ti); 194 195 s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE; 196 if (ret != 0) { 197 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 198 tpmSts, 1); /* fatal error */ 199 } 200 } 201 202 static enum TPMVersion tpm_crb_get_version(TPMIf *ti) 203 { 204 CRBState *s = CRB(ti); 205 206 return tpm_backend_get_tpm_version(s->tpmbe); 207 } 208 209 static int tpm_crb_pre_save(void *opaque) 210 { 211 CRBState *s = opaque; 212 213 tpm_backend_finish_sync(s->tpmbe); 214 215 return 0; 216 } 217 218 static const VMStateDescription vmstate_tpm_crb = { 219 .name = "tpm-crb", 220 .pre_save = tpm_crb_pre_save, 221 .fields = (VMStateField[]) { 222 VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX), 223 VMSTATE_END_OF_LIST(), 224 } 225 }; 226 227 static Property tpm_crb_properties[] = { 228 DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe), 229 DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true), 230 DEFINE_PROP_END_OF_LIST(), 231 }; 232 233 static void tpm_crb_reset(void *dev) 234 { 235 CRBState *s = CRB(dev); 236 237 if (s->ppi_enabled) { 238 tpm_ppi_reset(&s->ppi); 239 } 240 tpm_backend_reset(s->tpmbe); 241 242 memset(s->regs, 0, sizeof(s->regs)); 243 244 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 245 tpmRegValidSts, 1); 246 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 247 tpmIdle, 1); 248 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 249 InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE); 250 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 251 InterfaceVersion, CRB_INTF_VERSION_CRB); 252 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 253 CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY); 254 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 255 CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST); 256 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 257 CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64); 258 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 259 CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED); 260 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 261 CapCRB, CRB_INTF_CAP_CRB_SUPPORTED); 262 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 263 InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB); 264 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 265 RID, 0b0000); 266 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2, 267 VID, PCI_VENDOR_ID_IBM); 268 269 s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE; 270 s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER; 271 s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE; 272 s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER; 273 274 s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe), 275 CRB_CTRL_CMD_SIZE); 276 277 if (tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size) < 0) { 278 exit(1); 279 } 280 } 281 282 static void tpm_crb_realize(DeviceState *dev, Error **errp) 283 { 284 CRBState *s = CRB(dev); 285 286 if (!tpm_find()) { 287 error_setg(errp, "at most one TPM device is permitted"); 288 return; 289 } 290 if (!s->tpmbe) { 291 error_setg(errp, "'tpmdev' property is required"); 292 return; 293 } 294 295 memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s, 296 "tpm-crb-mmio", sizeof(s->regs)); 297 memory_region_init_ram(&s->cmdmem, OBJECT(s), 298 "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp); 299 300 memory_region_add_subregion(get_system_memory(), 301 TPM_CRB_ADDR_BASE, &s->mmio); 302 memory_region_add_subregion(get_system_memory(), 303 TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem); 304 305 if (s->ppi_enabled) { 306 tpm_ppi_init(&s->ppi, get_system_memory(), 307 TPM_PPI_ADDR_BASE, OBJECT(s)); 308 } 309 310 qemu_register_reset(tpm_crb_reset, dev); 311 } 312 313 static void tpm_crb_class_init(ObjectClass *klass, void *data) 314 { 315 DeviceClass *dc = DEVICE_CLASS(klass); 316 TPMIfClass *tc = TPM_IF_CLASS(klass); 317 318 dc->realize = tpm_crb_realize; 319 device_class_set_props(dc, tpm_crb_properties); 320 dc->vmsd = &vmstate_tpm_crb; 321 dc->user_creatable = true; 322 tc->model = TPM_MODEL_TPM_CRB; 323 tc->get_version = tpm_crb_get_version; 324 tc->request_completed = tpm_crb_request_completed; 325 326 set_bit(DEVICE_CATEGORY_MISC, dc->categories); 327 } 328 329 static const TypeInfo tpm_crb_info = { 330 .name = TYPE_TPM_CRB, 331 /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */ 332 .parent = TYPE_DEVICE, 333 .instance_size = sizeof(CRBState), 334 .class_init = tpm_crb_class_init, 335 .interfaces = (InterfaceInfo[]) { 336 { TYPE_TPM_IF }, 337 { } 338 } 339 }; 340 341 static void tpm_crb_register(void) 342 { 343 type_register_static(&tpm_crb_info); 344 } 345 346 type_init(tpm_crb_register) 347