1 /* 2 * tpm_crb.c - QEMU's TPM CRB interface emulator 3 * 4 * Copyright (c) 2018 Red Hat, Inc. 5 * 6 * Authors: 7 * Marc-André Lureau <marcandre.lureau@redhat.com> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface 13 * as defined in TCG PC Client Platform TPM Profile (PTP) Specification 14 * Family “2.0” Level 00 Revision 01.03 v22 15 */ 16 17 #include "qemu/osdep.h" 18 19 #include "qemu-common.h" 20 #include "qapi/error.h" 21 #include "exec/address-spaces.h" 22 23 #include "hw/qdev-core.h" 24 #include "hw/qdev-properties.h" 25 #include "hw/pci/pci_ids.h" 26 #include "hw/acpi/tpm.h" 27 #include "migration/vmstate.h" 28 #include "sysemu/tpm_backend.h" 29 #include "sysemu/reset.h" 30 #include "tpm_int.h" 31 #include "tpm_util.h" 32 #include "trace.h" 33 34 typedef struct CRBState { 35 DeviceState parent_obj; 36 37 TPMBackend *tpmbe; 38 TPMBackendCmd cmd; 39 uint32_t regs[TPM_CRB_R_MAX]; 40 MemoryRegion mmio; 41 MemoryRegion cmdmem; 42 43 size_t be_buffer_size; 44 } CRBState; 45 46 #define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB) 47 48 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1 49 #define CRB_INTF_VERSION_CRB 0b1 50 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0 51 #define CRB_INTF_CAP_IDLE_FAST 0b0 52 #define CRB_INTF_CAP_XFER_SIZE_64 0b11 53 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0 54 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1 55 #define CRB_INTF_IF_SELECTOR_CRB 0b1 56 57 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER) 58 59 enum crb_loc_ctrl { 60 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0), 61 CRB_LOC_CTRL_RELINQUISH = BIT(1), 62 CRB_LOC_CTRL_SEIZE = BIT(2), 63 CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3), 64 }; 65 66 enum crb_ctrl_req { 67 CRB_CTRL_REQ_CMD_READY = BIT(0), 68 CRB_CTRL_REQ_GO_IDLE = BIT(1), 69 }; 70 71 enum crb_start { 72 CRB_START_INVOKE = BIT(0), 73 }; 74 75 enum crb_cancel { 76 CRB_CANCEL_INVOKE = BIT(0), 77 }; 78 79 static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr, 80 unsigned size) 81 { 82 CRBState *s = CRB(opaque); 83 void *regs = (void *)&s->regs + (addr & ~3); 84 unsigned offset = addr & 3; 85 uint32_t val = *(uint32_t *)regs >> (8 * offset); 86 87 trace_tpm_crb_mmio_read(addr, size, val); 88 89 return val; 90 } 91 92 static void tpm_crb_mmio_write(void *opaque, hwaddr addr, 93 uint64_t val, unsigned size) 94 { 95 CRBState *s = CRB(opaque); 96 97 trace_tpm_crb_mmio_write(addr, size, val); 98 99 switch (addr) { 100 case A_CRB_CTRL_REQ: 101 switch (val) { 102 case CRB_CTRL_REQ_CMD_READY: 103 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 104 tpmIdle, 0); 105 break; 106 case CRB_CTRL_REQ_GO_IDLE: 107 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 108 tpmIdle, 1); 109 break; 110 } 111 break; 112 case A_CRB_CTRL_CANCEL: 113 if (val == CRB_CANCEL_INVOKE && 114 s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) { 115 tpm_backend_cancel_cmd(s->tpmbe); 116 } 117 break; 118 case A_CRB_CTRL_START: 119 if (val == CRB_START_INVOKE && 120 !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE)) { 121 void *mem = memory_region_get_ram_ptr(&s->cmdmem); 122 123 s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE; 124 s->cmd = (TPMBackendCmd) { 125 .in = mem, 126 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size), 127 .out = mem, 128 .out_len = s->be_buffer_size, 129 }; 130 131 tpm_backend_deliver_request(s->tpmbe, &s->cmd); 132 } 133 break; 134 case A_CRB_LOC_CTRL: 135 switch (val) { 136 case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT: 137 /* not loc 3 or 4 */ 138 break; 139 case CRB_LOC_CTRL_RELINQUISH: 140 break; 141 case CRB_LOC_CTRL_REQUEST_ACCESS: 142 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 143 Granted, 1); 144 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 145 beenSeized, 0); 146 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 147 locAssigned, 1); 148 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 149 tpmRegValidSts, 1); 150 break; 151 } 152 break; 153 } 154 } 155 156 static const MemoryRegionOps tpm_crb_memory_ops = { 157 .read = tpm_crb_mmio_read, 158 .write = tpm_crb_mmio_write, 159 .endianness = DEVICE_LITTLE_ENDIAN, 160 .valid = { 161 .min_access_size = 1, 162 .max_access_size = 4, 163 }, 164 }; 165 166 static void tpm_crb_request_completed(TPMIf *ti, int ret) 167 { 168 CRBState *s = CRB(ti); 169 170 s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE; 171 if (ret != 0) { 172 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 173 tpmSts, 1); /* fatal error */ 174 } 175 } 176 177 static enum TPMVersion tpm_crb_get_version(TPMIf *ti) 178 { 179 CRBState *s = CRB(ti); 180 181 return tpm_backend_get_tpm_version(s->tpmbe); 182 } 183 184 static int tpm_crb_pre_save(void *opaque) 185 { 186 CRBState *s = opaque; 187 188 tpm_backend_finish_sync(s->tpmbe); 189 190 return 0; 191 } 192 193 static const VMStateDescription vmstate_tpm_crb = { 194 .name = "tpm-crb", 195 .pre_save = tpm_crb_pre_save, 196 .fields = (VMStateField[]) { 197 VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX), 198 VMSTATE_END_OF_LIST(), 199 } 200 }; 201 202 static Property tpm_crb_properties[] = { 203 DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe), 204 DEFINE_PROP_END_OF_LIST(), 205 }; 206 207 static void tpm_crb_reset(void *dev) 208 { 209 CRBState *s = CRB(dev); 210 211 tpm_backend_reset(s->tpmbe); 212 213 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 214 InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE); 215 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 216 InterfaceVersion, CRB_INTF_VERSION_CRB); 217 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 218 CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY); 219 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 220 CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST); 221 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 222 CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64); 223 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 224 CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED); 225 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 226 CapCRB, CRB_INTF_CAP_CRB_SUPPORTED); 227 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 228 InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB); 229 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 230 RID, 0b0000); 231 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2, 232 VID, PCI_VENDOR_ID_IBM); 233 234 s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE; 235 s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER; 236 s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE; 237 s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER; 238 239 s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe), 240 CRB_CTRL_CMD_SIZE); 241 242 tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size); 243 } 244 245 static void tpm_crb_realize(DeviceState *dev, Error **errp) 246 { 247 CRBState *s = CRB(dev); 248 249 if (!tpm_find()) { 250 error_setg(errp, "at most one TPM device is permitted"); 251 return; 252 } 253 if (!s->tpmbe) { 254 error_setg(errp, "'tpmdev' property is required"); 255 return; 256 } 257 258 memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s, 259 "tpm-crb-mmio", sizeof(s->regs)); 260 memory_region_init_ram(&s->cmdmem, OBJECT(s), 261 "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp); 262 263 memory_region_add_subregion(get_system_memory(), 264 TPM_CRB_ADDR_BASE, &s->mmio); 265 memory_region_add_subregion(get_system_memory(), 266 TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem); 267 268 qemu_register_reset(tpm_crb_reset, dev); 269 } 270 271 static void tpm_crb_class_init(ObjectClass *klass, void *data) 272 { 273 DeviceClass *dc = DEVICE_CLASS(klass); 274 TPMIfClass *tc = TPM_IF_CLASS(klass); 275 276 dc->realize = tpm_crb_realize; 277 dc->props = tpm_crb_properties; 278 dc->vmsd = &vmstate_tpm_crb; 279 dc->user_creatable = true; 280 tc->model = TPM_MODEL_TPM_CRB; 281 tc->get_version = tpm_crb_get_version; 282 tc->request_completed = tpm_crb_request_completed; 283 284 set_bit(DEVICE_CATEGORY_MISC, dc->categories); 285 } 286 287 static const TypeInfo tpm_crb_info = { 288 .name = TYPE_TPM_CRB, 289 /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */ 290 .parent = TYPE_DEVICE, 291 .instance_size = sizeof(CRBState), 292 .class_init = tpm_crb_class_init, 293 .interfaces = (InterfaceInfo[]) { 294 { TYPE_TPM_IF }, 295 { } 296 } 297 }; 298 299 static void tpm_crb_register(void) 300 { 301 type_register_static(&tpm_crb_info); 302 } 303 304 type_init(tpm_crb_register) 305