1 /* 2 * Copyright (c) 2013 Google, Inc 3 * 4 * SPDX-License-Identifier: GPL-2.0+ 5 */ 6 7 #include <common.h> 8 #include <asm/state.h> 9 #include <asm/unaligned.h> 10 #include <linux/crc8.h> 11 12 /* TPM NVRAM location indices. */ 13 #define FIRMWARE_NV_INDEX 0x1007 14 #define KERNEL_NV_INDEX 0x1008 15 16 #define NV_DATA_PUBLIC_PERMISSIONS_OFFSET 60 17 18 /* Kernel TPM space - KERNEL_NV_INDEX, locked with physical presence */ 19 #define ROLLBACK_SPACE_KERNEL_VERSION 2 20 #define ROLLBACK_SPACE_KERNEL_UID 0x4752574C /* 'GRWL' */ 21 22 struct rollback_space_kernel { 23 /* Struct version, for backwards compatibility */ 24 uint8_t struct_version; 25 /* Unique ID to detect space redefinition */ 26 uint32_t uid; 27 /* Kernel versions */ 28 uint32_t kernel_versions; 29 /* Reserved for future expansion */ 30 uint8_t reserved[3]; 31 /* Checksum (v2 and later only) */ 32 uint8_t crc8; 33 } __packed rollback_space_kernel; 34 35 /* 36 * These numbers derive from adding the sizes of command fields as shown in 37 * the TPM commands manual. 38 */ 39 #define TPM_REQUEST_HEADER_LENGTH 10 40 #define TPM_RESPONSE_HEADER_LENGTH 10 41 42 /* These are the different non-volatile spaces that we emulate */ 43 enum { 44 NV_GLOBAL_LOCK, 45 NV_SEQ_FIRMWARE, 46 NV_SEQ_KERNEL, 47 NV_SEQ_COUNT, 48 }; 49 50 /* Size of each non-volatile space */ 51 #define NV_DATA_SIZE 0x20 52 53 /* 54 * Information about our TPM emulation. This is preserved in the sandbox 55 * state file if enabled. 56 */ 57 static struct tpm_state { 58 uint8_t nvdata[NV_SEQ_COUNT][NV_DATA_SIZE]; 59 } state; 60 61 /** 62 * sandbox_tpm_read_state() - read the sandbox EC state from the state file 63 * 64 * If data is available, then blob and node will provide access to it. If 65 * not this function sets up an empty TPM. 66 * 67 * @blob: Pointer to device tree blob, or NULL if no data to read 68 * @node: Node offset to read from 69 */ 70 static int sandbox_tpm_read_state(const void *blob, int node) 71 { 72 const char *prop; 73 int len; 74 int i; 75 76 if (!blob) 77 return 0; 78 79 for (i = 0; i < NV_SEQ_COUNT; i++) { 80 char prop_name[20]; 81 82 sprintf(prop_name, "nvdata%d", i); 83 prop = fdt_getprop(blob, node, prop_name, &len); 84 if (prop && len == NV_DATA_SIZE) 85 memcpy(state.nvdata[i], prop, NV_DATA_SIZE); 86 } 87 88 return 0; 89 } 90 91 /** 92 * cros_ec_write_state() - Write out our state to the state file 93 * 94 * The caller will ensure that there is a node ready for the state. The node 95 * may already contain the old state, in which case it is overridden. 96 * 97 * @blob: Device tree blob holding state 98 * @node: Node to write our state into 99 */ 100 static int sandbox_tpm_write_state(void *blob, int node) 101 { 102 int i; 103 104 /* 105 * We are guaranteed enough space to write basic properties. 106 * We could use fdt_add_subnode() to put each set of data in its 107 * own node - perhaps useful if we add access informaiton to each. 108 */ 109 for (i = 0; i < NV_SEQ_COUNT; i++) { 110 char prop_name[20]; 111 112 sprintf(prop_name, "nvdata%d", i); 113 fdt_setprop(blob, node, prop_name, state.nvdata[i], 114 NV_DATA_SIZE); 115 } 116 117 return 0; 118 } 119 120 SANDBOX_STATE_IO(sandbox_tpm, "google,sandbox-tpm", sandbox_tpm_read_state, 121 sandbox_tpm_write_state); 122 123 static int index_to_seq(uint32_t index) 124 { 125 switch (index) { 126 case FIRMWARE_NV_INDEX: 127 return NV_SEQ_FIRMWARE; 128 case KERNEL_NV_INDEX: 129 return NV_SEQ_KERNEL; 130 case 0: 131 return NV_GLOBAL_LOCK; 132 } 133 134 printf("Invalid nv index %#x\n", index); 135 return -1; 136 } 137 138 int tis_sendrecv(const u8 *sendbuf, size_t send_size, 139 u8 *recvbuf, size_t *recv_len) 140 { 141 struct tpm_state *tpm = &state; 142 uint32_t code, index, length, type; 143 uint8_t *data; 144 int seq; 145 146 code = get_unaligned_be32(sendbuf + sizeof(uint16_t) + 147 sizeof(uint32_t)); 148 printf("tpm: %zd bytes, recv_len %zd, cmd = %x\n", send_size, 149 *recv_len, code); 150 print_buffer(0, sendbuf, 1, send_size, 0); 151 switch (code) { 152 case 0x65: /* get flags */ 153 type = get_unaligned_be32(sendbuf + 14); 154 switch (type) { 155 case 4: 156 index = get_unaligned_be32(sendbuf + 18); 157 printf("Get flags index %#02x\n", index); 158 *recv_len = 22; 159 memset(recvbuf, '\0', *recv_len); 160 put_unaligned_be32(22, recvbuf + 161 TPM_RESPONSE_HEADER_LENGTH); 162 data = recvbuf + TPM_RESPONSE_HEADER_LENGTH + 163 sizeof(uint32_t); 164 switch (index) { 165 case FIRMWARE_NV_INDEX: 166 break; 167 case KERNEL_NV_INDEX: 168 /* TPM_NV_PER_PPWRITE */ 169 put_unaligned_be32(1, data + 170 NV_DATA_PUBLIC_PERMISSIONS_OFFSET); 171 break; 172 } 173 break; 174 case 0x11: /* TPM_CAP_NV_INDEX */ 175 index = get_unaligned_be32(sendbuf + 18); 176 printf("Get cap nv index %#02x\n", index); 177 put_unaligned_be32(22, recvbuf + 178 TPM_RESPONSE_HEADER_LENGTH); 179 break; 180 default: 181 printf(" ** Unknown 0x65 command type %#02x\n", 182 type); 183 return -1; 184 } 185 break; 186 case 0xcd: /* nvwrite */ 187 index = get_unaligned_be32(sendbuf + 10); 188 length = get_unaligned_be32(sendbuf + 18); 189 seq = index_to_seq(index); 190 if (seq < 0) 191 return -1; 192 printf("tpm: nvwrite index=%#02x, len=%#02x\n", index, length); 193 memcpy(&tpm->nvdata[seq], sendbuf + 22, length); 194 *recv_len = 12; 195 memset(recvbuf, '\0', *recv_len); 196 break; 197 case 0xcf: /* nvread */ 198 index = get_unaligned_be32(sendbuf + 10); 199 length = get_unaligned_be32(sendbuf + 18); 200 seq = index_to_seq(index); 201 if (seq < 0) 202 return -1; 203 printf("tpm: nvread index=%#02x, len=%#02x\n", index, length); 204 *recv_len = TPM_RESPONSE_HEADER_LENGTH + sizeof(uint32_t) + 205 length; 206 memset(recvbuf, '\0', *recv_len); 207 put_unaligned_be32(length, recvbuf + 208 TPM_RESPONSE_HEADER_LENGTH); 209 if (seq == NV_SEQ_KERNEL) { 210 struct rollback_space_kernel rsk; 211 212 data = recvbuf + TPM_RESPONSE_HEADER_LENGTH + 213 sizeof(uint32_t); 214 rsk.struct_version = 2; 215 rsk.uid = ROLLBACK_SPACE_KERNEL_UID; 216 rsk.kernel_versions = 0; 217 rsk.crc8 = crc8((unsigned char *)&rsk, 218 offsetof(struct rollback_space_kernel, 219 crc8)); 220 memcpy(data, &rsk, sizeof(rsk)); 221 } else { 222 memcpy(recvbuf + TPM_RESPONSE_HEADER_LENGTH + 223 sizeof(uint32_t), &tpm->nvdata[seq], length); 224 } 225 break; 226 case 0x14: /* tpm extend */ 227 case 0x15: /* pcr read */ 228 case 0x5d: /* force clear */ 229 case 0x6f: /* physical enable */ 230 case 0x72: /* physical set deactivated */ 231 case 0x99: /* startup */ 232 case 0x4000000a: /* assert physical presence */ 233 *recv_len = 12; 234 memset(recvbuf, '\0', *recv_len); 235 break; 236 default: 237 printf("Unknown tpm command %02x\n", code); 238 return -1; 239 } 240 241 return 0; 242 } 243 244 int tis_open(void) 245 { 246 printf("%s\n", __func__); 247 return 0; 248 } 249 250 int tis_close(void) 251 { 252 printf("%s\n", __func__); 253 return 0; 254 } 255 256 int tis_init(void) 257 { 258 printf("%s\n", __func__); 259 return 0; 260 } 261