1 /* 2 * tpm_crb.c - QEMU's TPM CRB interface emulator 3 * 4 * Copyright (c) 2018 Red Hat, Inc. 5 * 6 * Authors: 7 * Marc-André Lureau <marcandre.lureau@redhat.com> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface 13 * as defined in TCG PC Client Platform TPM Profile (PTP) Specification 14 * Family “2.0” Level 00 Revision 01.03 v22 15 */ 16 17 #include "qemu/osdep.h" 18 19 #include "qemu/module.h" 20 #include "qapi/error.h" 21 #include "exec/address-spaces.h" 22 #include "hw/qdev-properties.h" 23 #include "hw/pci/pci_ids.h" 24 #include "hw/acpi/tpm.h" 25 #include "migration/vmstate.h" 26 #include "system/tpm_backend.h" 27 #include "system/tpm_util.h" 28 #include "system/reset.h" 29 #include "system/xen.h" 30 #include "tpm_prop.h" 31 #include "tpm_ppi.h" 32 #include "trace.h" 33 #include "qom/object.h" 34 35 struct CRBState { 36 DeviceState parent_obj; 37 38 TPMBackend *tpmbe; 39 TPMBackendCmd cmd; 40 uint32_t regs[TPM_CRB_R_MAX]; 41 MemoryRegion mmio; 42 MemoryRegion cmdmem; 43 44 size_t be_buffer_size; 45 46 bool ppi_enabled; 47 TPMPPI ppi; 48 }; 49 typedef struct CRBState CRBState; 50 51 DECLARE_INSTANCE_CHECKER(CRBState, CRB, 52 TYPE_TPM_CRB) 53 54 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1 55 #define CRB_INTF_VERSION_CRB 0b1 56 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0 57 #define CRB_INTF_CAP_IDLE_FAST 0b0 58 #define CRB_INTF_CAP_XFER_SIZE_64 0b11 59 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0 60 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1 61 #define CRB_INTF_IF_SELECTOR_CRB 0b1 62 63 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER) 64 65 enum crb_loc_ctrl { 66 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0), 67 CRB_LOC_CTRL_RELINQUISH = BIT(1), 68 CRB_LOC_CTRL_SEIZE = BIT(2), 69 CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3), 70 }; 71 72 enum crb_ctrl_req { 73 CRB_CTRL_REQ_CMD_READY = BIT(0), 74 CRB_CTRL_REQ_GO_IDLE = BIT(1), 75 }; 76 77 enum crb_start { 78 CRB_START_INVOKE = BIT(0), 79 }; 80 81 enum crb_cancel { 82 CRB_CANCEL_INVOKE = BIT(0), 83 }; 84 85 #define TPM_CRB_NO_LOCALITY 0xff 86 87 static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr, 88 unsigned size) 89 { 90 CRBState *s = CRB(opaque); 91 void *regs = (void *)&s->regs + (addr & ~3); 92 unsigned offset = addr & 3; 93 uint32_t val = *(uint32_t *)regs >> (8 * offset); 94 95 switch (addr) { 96 case A_CRB_LOC_STATE: 97 val |= !tpm_backend_get_tpm_established_flag(s->tpmbe); 98 break; 99 } 100 101 trace_tpm_crb_mmio_read(addr, size, val); 102 103 return val; 104 } 105 106 static uint8_t tpm_crb_get_active_locty(CRBState *s) 107 { 108 if (!ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, locAssigned)) { 109 return TPM_CRB_NO_LOCALITY; 110 } 111 return ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, activeLocality); 112 } 113 114 static void tpm_crb_mmio_write(void *opaque, hwaddr addr, 115 uint64_t val, unsigned size) 116 { 117 CRBState *s = CRB(opaque); 118 uint8_t locty = addr >> 12; 119 120 trace_tpm_crb_mmio_write(addr, size, val); 121 122 switch (addr) { 123 case A_CRB_CTRL_REQ: 124 switch (val) { 125 case CRB_CTRL_REQ_CMD_READY: 126 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 127 tpmIdle, 0); 128 break; 129 case CRB_CTRL_REQ_GO_IDLE: 130 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 131 tpmIdle, 1); 132 break; 133 } 134 break; 135 case A_CRB_CTRL_CANCEL: 136 if (val == CRB_CANCEL_INVOKE && 137 s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) { 138 tpm_backend_cancel_cmd(s->tpmbe); 139 } 140 break; 141 case A_CRB_CTRL_START: 142 if (val == CRB_START_INVOKE && 143 !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) && 144 tpm_crb_get_active_locty(s) == locty) { 145 void *mem = memory_region_get_ram_ptr(&s->cmdmem); 146 147 s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE; 148 s->cmd = (TPMBackendCmd) { 149 .in = mem, 150 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size), 151 .out = mem, 152 .out_len = s->be_buffer_size, 153 }; 154 155 tpm_backend_deliver_request(s->tpmbe, &s->cmd); 156 } 157 break; 158 case A_CRB_LOC_CTRL: 159 switch (val) { 160 case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT: 161 /* not loc 3 or 4 */ 162 break; 163 case CRB_LOC_CTRL_RELINQUISH: 164 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 165 locAssigned, 0); 166 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 167 Granted, 0); 168 break; 169 case CRB_LOC_CTRL_REQUEST_ACCESS: 170 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 171 Granted, 1); 172 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS, 173 beenSeized, 0); 174 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 175 locAssigned, 1); 176 break; 177 } 178 break; 179 } 180 } 181 182 static const MemoryRegionOps tpm_crb_memory_ops = { 183 .read = tpm_crb_mmio_read, 184 .write = tpm_crb_mmio_write, 185 .endianness = DEVICE_LITTLE_ENDIAN, 186 .valid = { 187 .min_access_size = 1, 188 .max_access_size = 4, 189 }, 190 }; 191 192 static void tpm_crb_request_completed(TPMIf *ti, int ret) 193 { 194 CRBState *s = CRB(ti); 195 196 s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE; 197 if (ret != 0) { 198 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 199 tpmSts, 1); /* fatal error */ 200 } 201 memory_region_set_dirty(&s->cmdmem, 0, CRB_CTRL_CMD_SIZE); 202 } 203 204 static enum TPMVersion tpm_crb_get_version(TPMIf *ti) 205 { 206 CRBState *s = CRB(ti); 207 208 return tpm_backend_get_tpm_version(s->tpmbe); 209 } 210 211 static int tpm_crb_pre_save(void *opaque) 212 { 213 CRBState *s = opaque; 214 215 tpm_backend_finish_sync(s->tpmbe); 216 217 return 0; 218 } 219 220 static const VMStateDescription vmstate_tpm_crb = { 221 .name = "tpm-crb", 222 .pre_save = tpm_crb_pre_save, 223 .fields = (const VMStateField[]) { 224 VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX), 225 VMSTATE_END_OF_LIST(), 226 } 227 }; 228 229 static const Property tpm_crb_properties[] = { 230 DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe), 231 DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true), 232 }; 233 234 static void tpm_crb_reset(void *dev) 235 { 236 CRBState *s = CRB(dev); 237 238 if (s->ppi_enabled) { 239 tpm_ppi_reset(&s->ppi); 240 } 241 tpm_backend_reset(s->tpmbe); 242 243 memset(s->regs, 0, sizeof(s->regs)); 244 245 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE, 246 tpmRegValidSts, 1); 247 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, 248 tpmIdle, 1); 249 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 250 InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE); 251 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 252 InterfaceVersion, CRB_INTF_VERSION_CRB); 253 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 254 CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY); 255 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 256 CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST); 257 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 258 CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64); 259 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 260 CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED); 261 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 262 CapCRB, CRB_INTF_CAP_CRB_SUPPORTED); 263 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 264 InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB); 265 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID, 266 RID, 0b0000); 267 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2, 268 VID, PCI_VENDOR_ID_IBM); 269 270 s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE; 271 s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER; 272 s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE; 273 s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER; 274 275 s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe), 276 CRB_CTRL_CMD_SIZE); 277 278 if (tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size) < 0) { 279 exit(1); 280 } 281 } 282 283 static void tpm_crb_realize(DeviceState *dev, Error **errp) 284 { 285 CRBState *s = CRB(dev); 286 287 if (!tpm_find()) { 288 error_setg(errp, "at most one TPM device is permitted"); 289 return; 290 } 291 if (!s->tpmbe) { 292 error_setg(errp, "'tpmdev' property is required"); 293 return; 294 } 295 296 memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s, 297 "tpm-crb-mmio", sizeof(s->regs)); 298 memory_region_init_ram(&s->cmdmem, OBJECT(s), 299 "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp); 300 301 memory_region_add_subregion(get_system_memory(), 302 TPM_CRB_ADDR_BASE, &s->mmio); 303 memory_region_add_subregion(get_system_memory(), 304 TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem); 305 306 if (s->ppi_enabled) { 307 tpm_ppi_init(&s->ppi, get_system_memory(), 308 TPM_PPI_ADDR_BASE, OBJECT(s)); 309 } 310 311 if (xen_enabled()) { 312 tpm_crb_reset(dev); 313 } else { 314 qemu_register_reset(tpm_crb_reset, dev); 315 } 316 } 317 318 static void tpm_crb_class_init(ObjectClass *klass, void *data) 319 { 320 DeviceClass *dc = DEVICE_CLASS(klass); 321 TPMIfClass *tc = TPM_IF_CLASS(klass); 322 323 dc->realize = tpm_crb_realize; 324 device_class_set_props(dc, tpm_crb_properties); 325 dc->vmsd = &vmstate_tpm_crb; 326 dc->user_creatable = true; 327 tc->model = TPM_MODEL_TPM_CRB; 328 tc->get_version = tpm_crb_get_version; 329 tc->request_completed = tpm_crb_request_completed; 330 331 set_bit(DEVICE_CATEGORY_MISC, dc->categories); 332 } 333 334 static const TypeInfo tpm_crb_info = { 335 .name = TYPE_TPM_CRB, 336 /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */ 337 .parent = TYPE_DEVICE, 338 .instance_size = sizeof(CRBState), 339 .class_init = tpm_crb_class_init, 340 .interfaces = (InterfaceInfo[]) { 341 { TYPE_TPM_IF }, 342 { } 343 } 344 }; 345 346 static void tpm_crb_register(void) 347 { 348 type_register_static(&tpm_crb_info); 349 } 350 351 type_init(tpm_crb_register) 352