xref: /qemu/hw/tpm/tpm_crb.c (revision 1fe8ac35) 
1 /*
2  * tpm_crb.c - QEMU's TPM CRB interface emulator
3  *
4  * Copyright (c) 2018 Red Hat, Inc.
5  *
6  * Authors:
7  *   Marc-André Lureau <marcandre.lureau@redhat.com>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
10  * See the COPYING file in the top-level directory.
11  *
12  * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface
13  * as defined in TCG PC Client Platform TPM Profile (PTP) Specification
14  * Family “2.0” Level 00 Revision 01.03 v22
15  */
16 
17 #include "qemu/osdep.h"
18 
19 #include "qemu/module.h"
20 #include "qapi/error.h"
21 #include "exec/address-spaces.h"
22 #include "hw/qdev-properties.h"
23 #include "hw/pci/pci_ids.h"
24 #include "hw/acpi/tpm.h"
25 #include "migration/vmstate.h"
26 #include "sysemu/tpm_backend.h"
27 #include "sysemu/tpm_util.h"
28 #include "sysemu/reset.h"
29 #include "tpm_prop.h"
30 #include "tpm_ppi.h"
31 #include "trace.h"
32 #include "qom/object.h"
33 
34 struct CRBState {
35     DeviceState parent_obj;
36 
37     TPMBackend *tpmbe;
38     TPMBackendCmd cmd;
39     uint32_t regs[TPM_CRB_R_MAX];
40     MemoryRegion mmio;
41     MemoryRegion cmdmem;
42 
43     size_t be_buffer_size;
44 
45     bool ppi_enabled;
46     TPMPPI ppi;
47 };
48 typedef struct CRBState CRBState;
49 
50 DECLARE_INSTANCE_CHECKER(CRBState, CRB,
51                          TYPE_TPM_CRB)
52 
53 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1
54 #define CRB_INTF_VERSION_CRB 0b1
55 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0
56 #define CRB_INTF_CAP_IDLE_FAST 0b0
57 #define CRB_INTF_CAP_XFER_SIZE_64 0b11
58 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0
59 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1
60 #define CRB_INTF_IF_SELECTOR_CRB 0b1
61 
62 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER)
63 
64 enum crb_loc_ctrl {
65     CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0),
66     CRB_LOC_CTRL_RELINQUISH = BIT(1),
67     CRB_LOC_CTRL_SEIZE = BIT(2),
68     CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3),
69 };
70 
71 enum crb_ctrl_req {
72     CRB_CTRL_REQ_CMD_READY = BIT(0),
73     CRB_CTRL_REQ_GO_IDLE = BIT(1),
74 };
75 
76 enum crb_start {
77     CRB_START_INVOKE = BIT(0),
78 };
79 
80 enum crb_cancel {
81     CRB_CANCEL_INVOKE = BIT(0),
82 };
83 
84 #define TPM_CRB_NO_LOCALITY 0xff
85 
86 static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr,
87                                   unsigned size)
88 {
89     CRBState *s = CRB(opaque);
90     void *regs = (void *)&s->regs + (addr & ~3);
91     unsigned offset = addr & 3;
92     uint32_t val = *(uint32_t *)regs >> (8 * offset);
93 
94     switch (addr) {
95     case A_CRB_LOC_STATE:
96         val |= !tpm_backend_get_tpm_established_flag(s->tpmbe);
97         break;
98     }
99 
100     trace_tpm_crb_mmio_read(addr, size, val);
101 
102     return val;
103 }
104 
105 static uint8_t tpm_crb_get_active_locty(CRBState *s)
106 {
107     if (!ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, locAssigned)) {
108         return TPM_CRB_NO_LOCALITY;
109     }
110     return ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, activeLocality);
111 }
112 
113 static void tpm_crb_mmio_write(void *opaque, hwaddr addr,
114                                uint64_t val, unsigned size)
115 {
116     CRBState *s = CRB(opaque);
117     uint8_t locty =  addr >> 12;
118 
119     trace_tpm_crb_mmio_write(addr, size, val);
120 
121     switch (addr) {
122     case A_CRB_CTRL_REQ:
123         switch (val) {
124         case CRB_CTRL_REQ_CMD_READY:
125             ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
126                              tpmIdle, 0);
127             break;
128         case CRB_CTRL_REQ_GO_IDLE:
129             ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
130                              tpmIdle, 1);
131             break;
132         }
133         break;
134     case A_CRB_CTRL_CANCEL:
135         if (val == CRB_CANCEL_INVOKE &&
136             s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) {
137             tpm_backend_cancel_cmd(s->tpmbe);
138         }
139         break;
140     case A_CRB_CTRL_START:
141         if (val == CRB_START_INVOKE &&
142             !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) &&
143             tpm_crb_get_active_locty(s) == locty) {
144             void *mem = memory_region_get_ram_ptr(&s->cmdmem);
145 
146             s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE;
147             s->cmd = (TPMBackendCmd) {
148                 .in = mem,
149                 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size),
150                 .out = mem,
151                 .out_len = s->be_buffer_size,
152             };
153 
154             tpm_backend_deliver_request(s->tpmbe, &s->cmd);
155         }
156         break;
157     case A_CRB_LOC_CTRL:
158         switch (val) {
159         case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT:
160             /* not loc 3 or 4 */
161             break;
162         case CRB_LOC_CTRL_RELINQUISH:
163             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
164                              locAssigned, 0);
165             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
166                              Granted, 0);
167             break;
168         case CRB_LOC_CTRL_REQUEST_ACCESS:
169             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
170                              Granted, 1);
171             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
172                              beenSeized, 0);
173             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
174                              locAssigned, 1);
175             break;
176         }
177         break;
178     }
179 }
180 
181 static const MemoryRegionOps tpm_crb_memory_ops = {
182     .read = tpm_crb_mmio_read,
183     .write = tpm_crb_mmio_write,
184     .endianness = DEVICE_LITTLE_ENDIAN,
185     .valid = {
186         .min_access_size = 1,
187         .max_access_size = 4,
188     },
189 };
190 
191 static void tpm_crb_request_completed(TPMIf *ti, int ret)
192 {
193     CRBState *s = CRB(ti);
194 
195     s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE;
196     if (ret != 0) {
197         ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
198                          tpmSts, 1); /* fatal error */
199     }
200     memory_region_set_dirty(&s->cmdmem, 0, CRB_CTRL_CMD_SIZE);
201 }
202 
203 static enum TPMVersion tpm_crb_get_version(TPMIf *ti)
204 {
205     CRBState *s = CRB(ti);
206 
207     return tpm_backend_get_tpm_version(s->tpmbe);
208 }
209 
210 static int tpm_crb_pre_save(void *opaque)
211 {
212     CRBState *s = opaque;
213 
214     tpm_backend_finish_sync(s->tpmbe);
215 
216     return 0;
217 }
218 
219 static const VMStateDescription vmstate_tpm_crb = {
220     .name = "tpm-crb",
221     .pre_save = tpm_crb_pre_save,
222     .fields = (VMStateField[]) {
223         VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX),
224         VMSTATE_END_OF_LIST(),
225     }
226 };
227 
228 static Property tpm_crb_properties[] = {
229     DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe),
230     DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true),
231     DEFINE_PROP_END_OF_LIST(),
232 };
233 
234 static void tpm_crb_reset(void *dev)
235 {
236     CRBState *s = CRB(dev);
237 
238     if (s->ppi_enabled) {
239         tpm_ppi_reset(&s->ppi);
240     }
241     tpm_backend_reset(s->tpmbe);
242 
243     memset(s->regs, 0, sizeof(s->regs));
244 
245     ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
246                      tpmRegValidSts, 1);
247     ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
248                      tpmIdle, 1);
249     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
250                      InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE);
251     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
252                      InterfaceVersion, CRB_INTF_VERSION_CRB);
253     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
254                      CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY);
255     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
256                      CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST);
257     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
258                      CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64);
259     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
260                      CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED);
261     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
262                      CapCRB, CRB_INTF_CAP_CRB_SUPPORTED);
263     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
264                      InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB);
265     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
266                      RID, 0b0000);
267     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2,
268                      VID, PCI_VENDOR_ID_IBM);
269 
270     s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE;
271     s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
272     s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE;
273     s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
274 
275     s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe),
276                             CRB_CTRL_CMD_SIZE);
277 
278     if (tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size) < 0) {
279         exit(1);
280     }
281 }
282 
283 static void tpm_crb_realize(DeviceState *dev, Error **errp)
284 {
285     CRBState *s = CRB(dev);
286 
287     if (!tpm_find()) {
288         error_setg(errp, "at most one TPM device is permitted");
289         return;
290     }
291     if (!s->tpmbe) {
292         error_setg(errp, "'tpmdev' property is required");
293         return;
294     }
295 
296     memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s,
297         "tpm-crb-mmio", sizeof(s->regs));
298     memory_region_init_ram(&s->cmdmem, OBJECT(s),
299         "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp);
300 
301     memory_region_add_subregion(get_system_memory(),
302         TPM_CRB_ADDR_BASE, &s->mmio);
303     memory_region_add_subregion(get_system_memory(),
304         TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem);
305 
306     if (s->ppi_enabled) {
307         tpm_ppi_init(&s->ppi, get_system_memory(),
308                      TPM_PPI_ADDR_BASE, OBJECT(s));
309     }
310 
311     qemu_register_reset(tpm_crb_reset, dev);
312 }
313 
314 static void tpm_crb_class_init(ObjectClass *klass, void *data)
315 {
316     DeviceClass *dc = DEVICE_CLASS(klass);
317     TPMIfClass *tc = TPM_IF_CLASS(klass);
318 
319     dc->realize = tpm_crb_realize;
320     device_class_set_props(dc, tpm_crb_properties);
321     dc->vmsd  = &vmstate_tpm_crb;
322     dc->user_creatable = true;
323     tc->model = TPM_MODEL_TPM_CRB;
324     tc->get_version = tpm_crb_get_version;
325     tc->request_completed = tpm_crb_request_completed;
326 
327     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
328 }
329 
330 static const TypeInfo tpm_crb_info = {
331     .name = TYPE_TPM_CRB,
332     /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */
333     .parent = TYPE_DEVICE,
334     .instance_size = sizeof(CRBState),
335     .class_init  = tpm_crb_class_init,
336     .interfaces = (InterfaceInfo[]) {
337         { TYPE_TPM_IF },
338         { }
339     }
340 };
341 
342 static void tpm_crb_register(void)
343 {
344     type_register_static(&tpm_crb_info);
345 }
346 
347 type_init(tpm_crb_register)
348