Merge remote-tracking branch 'remotes/vivier/tags/trivial-branch-for-6.2-pull-request...
[qemu.git] / hw / tpm / tpm_crb.c
1 /*
2 * tpm_crb.c - QEMU's TPM CRB interface emulator
3 *
4 * Copyright (c) 2018 Red Hat, Inc.
5 *
6 * Authors:
7 * Marc-André Lureau <marcandre.lureau@redhat.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
11 *
12 * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface
13 * as defined in TCG PC Client Platform TPM Profile (PTP) Specification
14 * Family “2.0” Level 00 Revision 01.03 v22
15 */
16
17 #include "qemu/osdep.h"
18
19 #include "qemu/module.h"
20 #include "qapi/error.h"
21 #include "hw/qdev-properties.h"
22 #include "hw/pci/pci_ids.h"
23 #include "hw/acpi/tpm.h"
24 #include "migration/vmstate.h"
25 #include "sysemu/tpm_backend.h"
26 #include "sysemu/tpm_util.h"
27 #include "sysemu/reset.h"
28 #include "tpm_prop.h"
29 #include "tpm_ppi.h"
30 #include "trace.h"
31 #include "qom/object.h"
32
33 struct CRBState {
34 DeviceState parent_obj;
35
36 TPMBackend *tpmbe;
37 TPMBackendCmd cmd;
38 uint32_t regs[TPM_CRB_R_MAX];
39 MemoryRegion mmio;
40 MemoryRegion cmdmem;
41
42 size_t be_buffer_size;
43
44 bool ppi_enabled;
45 TPMPPI ppi;
46 };
47 typedef struct CRBState CRBState;
48
49 DECLARE_INSTANCE_CHECKER(CRBState, CRB,
50 TYPE_TPM_CRB)
51
52 #define CRB_INTF_TYPE_CRB_ACTIVE 0b1
53 #define CRB_INTF_VERSION_CRB 0b1
54 #define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0
55 #define CRB_INTF_CAP_IDLE_FAST 0b0
56 #define CRB_INTF_CAP_XFER_SIZE_64 0b11
57 #define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0
58 #define CRB_INTF_CAP_CRB_SUPPORTED 0b1
59 #define CRB_INTF_IF_SELECTOR_CRB 0b1
60
61 #define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER)
62
63 enum crb_loc_ctrl {
64 CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0),
65 CRB_LOC_CTRL_RELINQUISH = BIT(1),
66 CRB_LOC_CTRL_SEIZE = BIT(2),
67 CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3),
68 };
69
70 enum crb_ctrl_req {
71 CRB_CTRL_REQ_CMD_READY = BIT(0),
72 CRB_CTRL_REQ_GO_IDLE = BIT(1),
73 };
74
75 enum crb_start {
76 CRB_START_INVOKE = BIT(0),
77 };
78
79 enum crb_cancel {
80 CRB_CANCEL_INVOKE = BIT(0),
81 };
82
83 #define TPM_CRB_NO_LOCALITY 0xff
84
85 static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr,
86 unsigned size)
87 {
88 CRBState *s = CRB(opaque);
89 void *regs = (void *)&s->regs + (addr & ~3);
90 unsigned offset = addr & 3;
91 uint32_t val = *(uint32_t *)regs >> (8 * offset);
92
93 switch (addr) {
94 case A_CRB_LOC_STATE:
95 val |= !tpm_backend_get_tpm_established_flag(s->tpmbe);
96 break;
97 }
98
99 trace_tpm_crb_mmio_read(addr, size, val);
100
101 return val;
102 }
103
104 static uint8_t tpm_crb_get_active_locty(CRBState *s)
105 {
106 if (!ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, locAssigned)) {
107 return TPM_CRB_NO_LOCALITY;
108 }
109 return ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, activeLocality);
110 }
111
112 static void tpm_crb_mmio_write(void *opaque, hwaddr addr,
113 uint64_t val, unsigned size)
114 {
115 CRBState *s = CRB(opaque);
116 uint8_t locty = addr >> 12;
117
118 trace_tpm_crb_mmio_write(addr, size, val);
119
120 switch (addr) {
121 case A_CRB_CTRL_REQ:
122 switch (val) {
123 case CRB_CTRL_REQ_CMD_READY:
124 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
125 tpmIdle, 0);
126 break;
127 case CRB_CTRL_REQ_GO_IDLE:
128 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
129 tpmIdle, 1);
130 break;
131 }
132 break;
133 case A_CRB_CTRL_CANCEL:
134 if (val == CRB_CANCEL_INVOKE &&
135 s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) {
136 tpm_backend_cancel_cmd(s->tpmbe);
137 }
138 break;
139 case A_CRB_CTRL_START:
140 if (val == CRB_START_INVOKE &&
141 !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) &&
142 tpm_crb_get_active_locty(s) == locty) {
143 void *mem = memory_region_get_ram_ptr(&s->cmdmem);
144
145 s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE;
146 s->cmd = (TPMBackendCmd) {
147 .in = mem,
148 .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size),
149 .out = mem,
150 .out_len = s->be_buffer_size,
151 };
152
153 tpm_backend_deliver_request(s->tpmbe, &s->cmd);
154 }
155 break;
156 case A_CRB_LOC_CTRL:
157 switch (val) {
158 case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT:
159 /* not loc 3 or 4 */
160 break;
161 case CRB_LOC_CTRL_RELINQUISH:
162 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
163 locAssigned, 0);
164 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
165 Granted, 0);
166 break;
167 case CRB_LOC_CTRL_REQUEST_ACCESS:
168 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
169 Granted, 1);
170 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
171 beenSeized, 0);
172 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
173 locAssigned, 1);
174 break;
175 }
176 break;
177 }
178 }
179
180 static const MemoryRegionOps tpm_crb_memory_ops = {
181 .read = tpm_crb_mmio_read,
182 .write = tpm_crb_mmio_write,
183 .endianness = DEVICE_LITTLE_ENDIAN,
184 .valid = {
185 .min_access_size = 1,
186 .max_access_size = 4,
187 },
188 };
189
190 static void tpm_crb_request_completed(TPMIf *ti, int ret)
191 {
192 CRBState *s = CRB(ti);
193
194 s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE;
195 if (ret != 0) {
196 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
197 tpmSts, 1); /* fatal error */
198 }
199 }
200
201 static enum TPMVersion tpm_crb_get_version(TPMIf *ti)
202 {
203 CRBState *s = CRB(ti);
204
205 return tpm_backend_get_tpm_version(s->tpmbe);
206 }
207
208 static int tpm_crb_pre_save(void *opaque)
209 {
210 CRBState *s = opaque;
211
212 tpm_backend_finish_sync(s->tpmbe);
213
214 return 0;
215 }
216
217 static const VMStateDescription vmstate_tpm_crb = {
218 .name = "tpm-crb",
219 .pre_save = tpm_crb_pre_save,
220 .fields = (VMStateField[]) {
221 VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX),
222 VMSTATE_END_OF_LIST(),
223 }
224 };
225
226 static Property tpm_crb_properties[] = {
227 DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe),
228 DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true),
229 DEFINE_PROP_END_OF_LIST(),
230 };
231
232 static void tpm_crb_reset(void *dev)
233 {
234 CRBState *s = CRB(dev);
235
236 if (s->ppi_enabled) {
237 tpm_ppi_reset(&s->ppi);
238 }
239 tpm_backend_reset(s->tpmbe);
240
241 memset(s->regs, 0, sizeof(s->regs));
242
243 ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
244 tpmRegValidSts, 1);
245 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
246 tpmIdle, 1);
247 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
248 InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE);
249 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
250 InterfaceVersion, CRB_INTF_VERSION_CRB);
251 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
252 CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY);
253 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
254 CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST);
255 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
256 CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64);
257 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
258 CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED);
259 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
260 CapCRB, CRB_INTF_CAP_CRB_SUPPORTED);
261 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
262 InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB);
263 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
264 RID, 0b0000);
265 ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2,
266 VID, PCI_VENDOR_ID_IBM);
267
268 s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE;
269 s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
270 s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE;
271 s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
272
273 s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe),
274 CRB_CTRL_CMD_SIZE);
275
276 if (tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size) < 0) {
277 exit(1);
278 }
279 }
280
281 static void tpm_crb_realize(DeviceState *dev, Error **errp)
282 {
283 CRBState *s = CRB(dev);
284
285 if (!tpm_find()) {
286 error_setg(errp, "at most one TPM device is permitted");
287 return;
288 }
289 if (!s->tpmbe) {
290 error_setg(errp, "'tpmdev' property is required");
291 return;
292 }
293
294 memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s,
295 "tpm-crb-mmio", sizeof(s->regs));
296 memory_region_init_ram(&s->cmdmem, OBJECT(s),
297 "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp);
298
299 memory_region_add_subregion(get_system_memory(),
300 TPM_CRB_ADDR_BASE, &s->mmio);
301 memory_region_add_subregion(get_system_memory(),
302 TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem);
303
304 if (s->ppi_enabled) {
305 tpm_ppi_init(&s->ppi, get_system_memory(),
306 TPM_PPI_ADDR_BASE, OBJECT(s));
307 }
308
309 qemu_register_reset(tpm_crb_reset, dev);
310 }
311
312 static void tpm_crb_class_init(ObjectClass *klass, void *data)
313 {
314 DeviceClass *dc = DEVICE_CLASS(klass);
315 TPMIfClass *tc = TPM_IF_CLASS(klass);
316
317 dc->realize = tpm_crb_realize;
318 device_class_set_props(dc, tpm_crb_properties);
319 dc->vmsd = &vmstate_tpm_crb;
320 dc->user_creatable = true;
321 tc->model = TPM_MODEL_TPM_CRB;
322 tc->get_version = tpm_crb_get_version;
323 tc->request_completed = tpm_crb_request_completed;
324
325 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
326 }
327
328 static const TypeInfo tpm_crb_info = {
329 .name = TYPE_TPM_CRB,
330 /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */
331 .parent = TYPE_DEVICE,
332 .instance_size = sizeof(CRBState),
333 .class_init = tpm_crb_class_init,
334 .interfaces = (InterfaceInfo[]) {
335 { TYPE_TPM_IF },
336 { }
337 }
338 };
339
340 static void tpm_crb_register(void)
341 {
342 type_register_static(&tpm_crb_info);
343 }
344
345 type_init(tpm_crb_register)