hw/tpm/tpm_crb.c

   1 /*
   2  * tpm_crb.c - QEMU's TPM CRB interface emulator
   3  *
   4  * Copyright (c) 2018 Red Hat, Inc.
   5  *
   6  * Authors:
   7  *   Marc-André Lureau <[email protected]>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  10  * See the COPYING file in the top-level directory.
  11  *
  12  * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface
  13  * as defined in TCG PC Client Platform TPM Profile (PTP) Specification
  14  * Family “2.0” Level 00 Revision 01.03 v22
  15  */
  16
  17 #include "qemu/osdep.h"
  18
  19 #include "qemu-common.h"
  20 #include "qapi/error.h"
  21 #include "exec/address-spaces.h"
  22
  23 #include "hw/qdev-core.h"
  24 #include "hw/qdev-properties.h"
  25 #include "hw/pci/pci_ids.h"
  26 #include "hw/acpi/tpm.h"
  27 #include "migration/vmstate.h"
  28 #include "sysemu/tpm_backend.h"
  29 #include "sysemu/reset.h"
  30 #include "tpm_int.h"
  31 #include "tpm_util.h"
  32
  33 typedef struct CRBState {
  34     DeviceState parent_obj;
  35
  36     TPMBackend *tpmbe;
  37     TPMBackendCmd cmd;
  38     uint32_t regs[TPM_CRB_R_MAX];
  39     MemoryRegion mmio;
  40     MemoryRegion cmdmem;
  41
  42     size_t be_buffer_size;
  43 } CRBState;
  44
  45 #define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB)
  46
  47 #define DEBUG_CRB 0
  48
  49 #define DPRINTF(fmt, ...) do {                  \
  50         if (DEBUG_CRB) {                        \
  51             printf(fmt, ## __VA_ARGS__);        \
  52         }                                       \
  53     } while (0)
  54
  55 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1
  56 #define CRB_INTF_VERSION_CRB 0b1
  57 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0
  58 #define CRB_INTF_CAP_IDLE_FAST 0b0
  59 #define CRB_INTF_CAP_XFER_SIZE_64 0b11
  60 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0
  61 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1
  62 #define CRB_INTF_IF_SELECTOR_CRB 0b1
  63
  64 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER)
  65
  66 enum crb_loc_ctrl {
  67     CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0),
  68     CRB_LOC_CTRL_RELINQUISH = BIT(1),
  69     CRB_LOC_CTRL_SEIZE = BIT(2),
  70     CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3),
  71 };
  72
  73 enum crb_ctrl_req {
  74     CRB_CTRL_REQ_CMD_READY = BIT(0),
  75     CRB_CTRL_REQ_GO_IDLE = BIT(1),
  76 };
  77
  78 enum crb_start {
  79     CRB_START_INVOKE = BIT(0),
  80 };
  81
  82 enum crb_cancel {
  83     CRB_CANCEL_INVOKE = BIT(0),
  84 };
  85
  86 static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr,
  87                                   unsigned size)
  88 {
  89     CRBState *s = CRB(opaque);
  90     void *regs = (void *)&s->regs + (addr & ~3);
  91     unsigned offset = addr & 3;
  92     uint32_t val = *(uint32_t *)regs >> (8 * offset);
  93
  94     DPRINTF("CRB read 0x" TARGET_FMT_plx " len:%u val: 0x%" PRIx32 "\n",
  95             addr, size, val);
  96     return val;
  97 }
  98
  99 static void tpm_crb_mmio_write(void *opaque, hwaddr addr,
 100                                uint64_t val, unsigned size)
 101 {
 102     CRBState *s = CRB(opaque);
 103     DPRINTF("CRB write 0x" TARGET_FMT_plx " len:%u val: 0x%" PRIx64 "\n",
 104             addr, size, val);
 105
 106     switch (addr) {
 107     case A_CRB_CTRL_REQ:
 108         switch (val) {
 109         case CRB_CTRL_REQ_CMD_READY:
 110             ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
 111                              tpmIdle, 0);
 112             break;
 113         case CRB_CTRL_REQ_GO_IDLE:
 114             ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
 115                              tpmIdle, 1);
 116             break;
 117         }
 118         break;
 119     case A_CRB_CTRL_CANCEL:
 120         if (val == CRB_CANCEL_INVOKE &&
 121             s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) {
 122             tpm_backend_cancel_cmd(s->tpmbe);
 123         }
 124         break;
 125     case A_CRB_CTRL_START:
 126         if (val == CRB_START_INVOKE &&
 127             !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE)) {
 128             void *mem = memory_region_get_ram_ptr(&s->cmdmem);
 129
 130             s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE;
 131             s->cmd = (TPMBackendCmd) {
 132                 .in = mem,
 133                 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size),
 134                 .out = mem,
 135                 .out_len = s->be_buffer_size,
 136             };
 137
 138             tpm_backend_deliver_request(s->tpmbe, &s->cmd);
 139         }
 140         break;
 141     case A_CRB_LOC_CTRL:
 142         switch (val) {
 143         case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT:
 144             /* not loc 3 or 4 */
 145             break;
 146         case CRB_LOC_CTRL_RELINQUISH:
 147             break;
 148         case CRB_LOC_CTRL_REQUEST_ACCESS:
 149             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
 150                              Granted, 1);
 151             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
 152                              beenSeized, 0);
 153             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
 154                              locAssigned, 1);
 155             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
 156                              tpmRegValidSts, 1);
 157             break;
 158         }
 159         break;
 160     }
 161 }
 162
 163 static const MemoryRegionOps tpm_crb_memory_ops = {
 164     .read = tpm_crb_mmio_read,
 165     .write = tpm_crb_mmio_write,
 166     .endianness = DEVICE_LITTLE_ENDIAN,
 167     .valid = {
 168         .min_access_size = 1,
 169         .max_access_size = 4,
 170     },
 171 };
 172
 173 static void tpm_crb_request_completed(TPMIf *ti, int ret)
 174 {
 175     CRBState *s = CRB(ti);
 176
 177     s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE;
 178     if (ret != 0) {
 179         ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
 180                          tpmSts, 1); /* fatal error */
 181     }
 182 }
 183
 184 static enum TPMVersion tpm_crb_get_version(TPMIf *ti)
 185 {
 186     CRBState *s = CRB(ti);
 187
 188     return tpm_backend_get_tpm_version(s->tpmbe);
 189 }
 190
 191 static int tpm_crb_pre_save(void *opaque)
 192 {
 193     CRBState *s = opaque;
 194
 195     tpm_backend_finish_sync(s->tpmbe);
 196
 197     return 0;
 198 }
 199
 200 static const VMStateDescription vmstate_tpm_crb = {
 201     .name = "tpm-crb",
 202     .pre_save = tpm_crb_pre_save,
 203     .fields = (VMStateField[]) {
 204         VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX),
 205         VMSTATE_END_OF_LIST(),
 206     }
 207 };
 208
 209 static Property tpm_crb_properties[] = {
 210     DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe),
 211     DEFINE_PROP_END_OF_LIST(),
 212 };
 213
 214 static void tpm_crb_reset(void *dev)
 215 {
 216     CRBState *s = CRB(dev);
 217
 218     tpm_backend_reset(s->tpmbe);
 219
 220     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 221                      InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE);
 222     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 223                      InterfaceVersion, CRB_INTF_VERSION_CRB);
 224     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 225                      CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY);
 226     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 227                      CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST);
 228     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 229                      CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64);
 230     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 231                      CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED);
 232     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 233                      CapCRB, CRB_INTF_CAP_CRB_SUPPORTED);
 234     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 235                      InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB);
 236     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 237                      RID, 0b0000);
 238     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2,
 239                      VID, PCI_VENDOR_ID_IBM);
 240
 241     s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE;
 242     s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
 243     s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE;
 244     s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
 245
 246     s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe),
 247                             CRB_CTRL_CMD_SIZE);
 248
 249     tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size);
 250 }
 251
 252 static void tpm_crb_realize(DeviceState *dev, Error **errp)
 253 {
 254     CRBState *s = CRB(dev);
 255
 256     if (!tpm_find()) {
 257         error_setg(errp, "at most one TPM device is permitted");
 258         return;
 259     }
 260     if (!s->tpmbe) {
 261         error_setg(errp, "'tpmdev' property is required");
 262         return;
 263     }
 264
 265     memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s,
 266         "tpm-crb-mmio", sizeof(s->regs));
 267     memory_region_init_ram(&s->cmdmem, OBJECT(s),
 268         "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp);
 269
 270     memory_region_add_subregion(get_system_memory(),
 271         TPM_CRB_ADDR_BASE, &s->mmio);
 272     memory_region_add_subregion(get_system_memory(),
 273         TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem);
 274
 275     qemu_register_reset(tpm_crb_reset, dev);
 276 }
 277
 278 static void tpm_crb_class_init(ObjectClass *klass, void *data)
 279 {
 280     DeviceClass *dc = DEVICE_CLASS(klass);
 281     TPMIfClass *tc = TPM_IF_CLASS(klass);
 282
 283     dc->realize = tpm_crb_realize;
 284     dc->props = tpm_crb_properties;
 285     dc->vmsd  = &vmstate_tpm_crb;
 286     dc->user_creatable = true;
 287     tc->model = TPM_MODEL_TPM_CRB;
 288     tc->get_version = tpm_crb_get_version;
 289     tc->request_completed = tpm_crb_request_completed;
 290
 291     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 292 }
 293
 294 static const TypeInfo tpm_crb_info = {
 295     .name = TYPE_TPM_CRB,
 296     /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */
 297     .parent = TYPE_DEVICE,
 298     .instance_size = sizeof(CRBState),
 299     .class_init  = tpm_crb_class_init,
 300     .interfaces = (InterfaceInfo[]) {
 301         { TYPE_TPM_IF },
 302         { }
 303     }
 304 };
 305
 306 static void tpm_crb_register(void)
 307 {
 308     type_register_static(&tpm_crb_info);
 309 }
 310
 311 type_init(tpm_crb_register)