hw/tpm/tpm_crb.c

   1 /*
   2  * tpm_crb.c - QEMU's TPM CRB interface emulator
   3  *
   4  * Copyright (c) 2018 Red Hat, Inc.
   5  *
   6  * Authors:
   7  *   Marc-André Lureau <marcandre.lureau@redhat.com>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  10  * See the COPYING file in the top-level directory.
  11  *
  12  * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface
  13  * as defined in TCG PC Client Platform TPM Profile (PTP) Specification
  14  * Family “2.0” Level 00 Revision 01.03 v22
  15  */
  16
  17 #include "qemu/osdep.h"
  18
  19 #include "qemu/module.h"
  20 #include "qapi/error.h"
  21 #include "exec/address-spaces.h"
  22 #include "hw/qdev-properties.h"
  23 #include "hw/pci/pci_ids.h"
  24 #include "hw/acpi/tpm.h"
  25 #include "migration/vmstate.h"
  26 #include "sysemu/tpm_backend.h"
  27 #include "sysemu/tpm_util.h"
  28 #include "sysemu/reset.h"
  29 #include "tpm_prop.h"
  30 #include "tpm_ppi.h"
  31 #include "trace.h"
  32 #include "qom/object.h"
  33
  34 struct CRBState {
  35     DeviceState parent_obj;
  36
  37     TPMBackend *tpmbe;
  38     TPMBackendCmd cmd;
  39     uint32_t regs[TPM_CRB_R_MAX];
  40     MemoryRegion mmio;
  41     MemoryRegion cmdmem;
  42
  43     size_t be_buffer_size;
  44
  45     bool ppi_enabled;
  46     TPMPPI ppi;
  47 };
  48 typedef struct CRBState CRBState;
  49
  50 DECLARE_INSTANCE_CHECKER(CRBState, CRB,
  51                          TYPE_TPM_CRB)
  52
  53 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1
  54 #define CRB_INTF_VERSION_CRB 0b1
  55 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0
  56 #define CRB_INTF_CAP_IDLE_FAST 0b0
  57 #define CRB_INTF_CAP_XFER_SIZE_64 0b11
  58 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0
  59 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1
  60 #define CRB_INTF_IF_SELECTOR_CRB 0b1
  61
  62 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER)
  63
  64 enum crb_loc_ctrl {
  65     CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0),
  66     CRB_LOC_CTRL_RELINQUISH = BIT(1),
  67     CRB_LOC_CTRL_SEIZE = BIT(2),
  68     CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3),
  69 };
  70
  71 enum crb_ctrl_req {
  72     CRB_CTRL_REQ_CMD_READY = BIT(0),
  73     CRB_CTRL_REQ_GO_IDLE = BIT(1),
  74 };
  75
  76 enum crb_start {
  77     CRB_START_INVOKE = BIT(0),
  78 };
  79
  80 enum crb_cancel {
  81     CRB_CANCEL_INVOKE = BIT(0),
  82 };
  83
  84 #define TPM_CRB_NO_LOCALITY 0xff
  85
  86 static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr,
  87                                   unsigned size)
  88 {
  89     CRBState *s = CRB(opaque);
  90     void *regs = (void *)&s->regs + (addr & ~3);
  91     unsigned offset = addr & 3;
  92     uint32_t val = *(uint32_t *)regs >> (8 * offset);
  93
  94     switch (addr) {
  95     case A_CRB_LOC_STATE:
  96         val |= !tpm_backend_get_tpm_established_flag(s->tpmbe);
  97         break;
  98     }
  99
 100     trace_tpm_crb_mmio_read(addr, size, val);
 101
 102     return val;
 103 }
 104
 105 static uint8_t tpm_crb_get_active_locty(CRBState *s)
 106 {
 107     if (!ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, locAssigned)) {
 108         return TPM_CRB_NO_LOCALITY;
 109     }
 110     return ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, activeLocality);
 111 }
 112
 113 static void tpm_crb_mmio_write(void *opaque, hwaddr addr,
 114                                uint64_t val, unsigned size)
 115 {
 116     CRBState *s = CRB(opaque);
 117     uint8_t locty =  addr >> 12;
 118
 119     trace_tpm_crb_mmio_write(addr, size, val);
 120
 121     switch (addr) {
 122     case A_CRB_CTRL_REQ:
 123         switch (val) {
 124         case CRB_CTRL_REQ_CMD_READY:
 125             ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
 126                              tpmIdle, 0);
 127             break;
 128         case CRB_CTRL_REQ_GO_IDLE:
 129             ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
 130                              tpmIdle, 1);
 131             break;
 132         }
 133         break;
 134     case A_CRB_CTRL_CANCEL:
 135         if (val == CRB_CANCEL_INVOKE &&
 136             s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) {
 137             tpm_backend_cancel_cmd(s->tpmbe);
 138         }
 139         break;
 140     case A_CRB_CTRL_START:
 141         if (val == CRB_START_INVOKE &&
 142             !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) &&
 143             tpm_crb_get_active_locty(s) == locty) {
 144             void *mem = memory_region_get_ram_ptr(&s->cmdmem);
 145
 146             s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE;
 147             s->cmd = (TPMBackendCmd) {
 148                 .in = mem,
 149                 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size),
 150                 .out = mem,
 151                 .out_len = s->be_buffer_size,
 152             };
 153
 154             tpm_backend_deliver_request(s->tpmbe, &s->cmd);
 155         }
 156         break;
 157     case A_CRB_LOC_CTRL:
 158         switch (val) {
 159         case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT:
 160             /* not loc 3 or 4 */
 161             break;
 162         case CRB_LOC_CTRL_RELINQUISH:
 163             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
 164                              locAssigned, 0);
 165             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
 166                              Granted, 0);
 167             break;
 168         case CRB_LOC_CTRL_REQUEST_ACCESS:
 169             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
 170                              Granted, 1);
 171             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
 172                              beenSeized, 0);
 173             ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
 174                              locAssigned, 1);
 175             break;
 176         }
 177         break;
 178     }
 179 }
 180
 181 static const MemoryRegionOps tpm_crb_memory_ops = {
 182     .read = tpm_crb_mmio_read,
 183     .write = tpm_crb_mmio_write,
 184     .endianness = DEVICE_LITTLE_ENDIAN,
 185     .valid = {
 186         .min_access_size = 1,
 187         .max_access_size = 4,
 188     },
 189 };
 190
 191 static void tpm_crb_request_completed(TPMIf *ti, int ret)
 192 {
 193     CRBState *s = CRB(ti);
 194
 195     s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE;
 196     if (ret != 0) {
 197         ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
 198                          tpmSts, 1); /* fatal error */
 199     }
 200 }
 201
 202 static enum TPMVersion tpm_crb_get_version(TPMIf *ti)
 203 {
 204     CRBState *s = CRB(ti);
 205
 206     return tpm_backend_get_tpm_version(s->tpmbe);
 207 }
 208
 209 static int tpm_crb_pre_save(void *opaque)
 210 {
 211     CRBState *s = opaque;
 212
 213     tpm_backend_finish_sync(s->tpmbe);
 214
 215     return 0;
 216 }
 217
 218 static const VMStateDescription vmstate_tpm_crb = {
 219     .name = "tpm-crb",
 220     .pre_save = tpm_crb_pre_save,
 221     .fields = (VMStateField[]) {
 222         VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX),
 223         VMSTATE_END_OF_LIST(),
 224     }
 225 };
 226
 227 static Property tpm_crb_properties[] = {
 228     DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe),
 229     DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true),
 230     DEFINE_PROP_END_OF_LIST(),
 231 };
 232
 233 static void tpm_crb_reset(void *dev)
 234 {
 235     CRBState *s = CRB(dev);
 236
 237     if (s->ppi_enabled) {
 238         tpm_ppi_reset(&s->ppi);
 239     }
 240     tpm_backend_reset(s->tpmbe);
 241
 242     memset(s->regs, 0, sizeof(s->regs));
 243
 244     ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
 245                      tpmRegValidSts, 1);
 246     ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
 247                      tpmIdle, 1);
 248     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 249                      InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE);
 250     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 251                      InterfaceVersion, CRB_INTF_VERSION_CRB);
 252     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 253                      CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY);
 254     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 255                      CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST);
 256     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 257                      CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64);
 258     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 259                      CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED);
 260     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 261                      CapCRB, CRB_INTF_CAP_CRB_SUPPORTED);
 262     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 263                      InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB);
 264     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
 265                      RID, 0b0000);
 266     ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2,
 267                      VID, PCI_VENDOR_ID_IBM);
 268
 269     s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE;
 270     s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
 271     s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE;
 272     s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
 273
 274     s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe),
 275                             CRB_CTRL_CMD_SIZE);
 276
 277     if (tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size) < 0) {
 278         exit(1);
 279     }
 280 }
 281
 282 static void tpm_crb_realize(DeviceState *dev, Error **errp)
 283 {
 284     CRBState *s = CRB(dev);
 285
 286     if (!tpm_find()) {
 287         error_setg(errp, "at most one TPM device is permitted");
 288         return;
 289     }
 290     if (!s->tpmbe) {
 291         error_setg(errp, "'tpmdev' property is required");
 292         return;
 293     }
 294
 295     memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s,
 296         "tpm-crb-mmio", sizeof(s->regs));
 297     memory_region_init_ram(&s->cmdmem, OBJECT(s),
 298         "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp);
 299
 300     memory_region_add_subregion(get_system_memory(),
 301         TPM_CRB_ADDR_BASE, &s->mmio);
 302     memory_region_add_subregion(get_system_memory(),
 303         TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem);
 304
 305     if (s->ppi_enabled) {
 306         tpm_ppi_init(&s->ppi, get_system_memory(),
 307                      TPM_PPI_ADDR_BASE, OBJECT(s));
 308     }
 309
 310     qemu_register_reset(tpm_crb_reset, dev);
 311 }
 312
 313 static void tpm_crb_class_init(ObjectClass *klass, void *data)
 314 {
 315     DeviceClass *dc = DEVICE_CLASS(klass);
 316     TPMIfClass *tc = TPM_IF_CLASS(klass);
 317
 318     dc->realize = tpm_crb_realize;
 319     device_class_set_props(dc, tpm_crb_properties);
 320     dc->vmsd  = &vmstate_tpm_crb;
 321     dc->user_creatable = true;
 322     tc->model = TPM_MODEL_TPM_CRB;
 323     tc->get_version = tpm_crb_get_version;
 324     tc->request_completed = tpm_crb_request_completed;
 325
 326     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 327 }
 328
 329 static const TypeInfo tpm_crb_info = {
 330     .name = TYPE_TPM_CRB,
 331     /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */
 332     .parent = TYPE_DEVICE,
 333     .instance_size = sizeof(CRBState),
 334     .class_init  = tpm_crb_class_init,
 335     .interfaces = (InterfaceInfo[]) {
 336         { TYPE_TPM_IF },
 337         { }
 338     }
 339 };
 340
 341 static void tpm_crb_register(void)
 342 {
 343     type_register_static(&tpm_crb_info);
 344 }
 345
 346 type_init(tpm_crb_register)