cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

tpm_crb.c (9839B)


      1/*
      2 * tpm_crb.c - QEMU's TPM CRB interface emulator
      3 *
      4 * Copyright (c) 2018 Red Hat, Inc.
      5 *
      6 * Authors:
      7 *   Marc-André Lureau <marcandre.lureau@redhat.com>
      8 *
      9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
     10 * See the COPYING file in the top-level directory.
     11 *
     12 * tpm_crb is a device for TPM 2.0 Command Response Buffer (CRB) Interface
     13 * as defined in TCG PC Client Platform TPM Profile (PTP) Specification
     14 * Family “2.0” Level 00 Revision 01.03 v22
     15 */
     16
     17#include "qemu/osdep.h"
     18
     19#include "qemu/module.h"
     20#include "qapi/error.h"
     21#include "hw/qdev-properties.h"
     22#include "hw/pci/pci_ids.h"
     23#include "hw/acpi/tpm.h"
     24#include "migration/vmstate.h"
     25#include "sysemu/tpm_backend.h"
     26#include "sysemu/tpm_util.h"
     27#include "sysemu/reset.h"
     28#include "tpm_prop.h"
     29#include "tpm_ppi.h"
     30#include "trace.h"
     31#include "qom/object.h"
     32
     33struct CRBState {
     34    DeviceState parent_obj;
     35
     36    TPMBackend *tpmbe;
     37    TPMBackendCmd cmd;
     38    uint32_t regs[TPM_CRB_R_MAX];
     39    MemoryRegion mmio;
     40    MemoryRegion cmdmem;
     41
     42    size_t be_buffer_size;
     43
     44    bool ppi_enabled;
     45    TPMPPI ppi;
     46};
     47typedef struct CRBState CRBState;
     48
     49DECLARE_INSTANCE_CHECKER(CRBState, CRB,
     50                         TYPE_TPM_CRB)
     51
     52#define CRB_INTF_TYPE_CRB_ACTIVE 0b1
     53#define CRB_INTF_VERSION_CRB 0b1
     54#define CRB_INTF_CAP_LOCALITY_0_ONLY 0b0
     55#define CRB_INTF_CAP_IDLE_FAST 0b0
     56#define CRB_INTF_CAP_XFER_SIZE_64 0b11
     57#define CRB_INTF_CAP_FIFO_NOT_SUPPORTED 0b0
     58#define CRB_INTF_CAP_CRB_SUPPORTED 0b1
     59#define CRB_INTF_IF_SELECTOR_CRB 0b1
     60
     61#define CRB_CTRL_CMD_SIZE (TPM_CRB_ADDR_SIZE - A_CRB_DATA_BUFFER)
     62
     63enum crb_loc_ctrl {
     64    CRB_LOC_CTRL_REQUEST_ACCESS = BIT(0),
     65    CRB_LOC_CTRL_RELINQUISH = BIT(1),
     66    CRB_LOC_CTRL_SEIZE = BIT(2),
     67    CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT = BIT(3),
     68};
     69
     70enum crb_ctrl_req {
     71    CRB_CTRL_REQ_CMD_READY = BIT(0),
     72    CRB_CTRL_REQ_GO_IDLE = BIT(1),
     73};
     74
     75enum crb_start {
     76    CRB_START_INVOKE = BIT(0),
     77};
     78
     79enum crb_cancel {
     80    CRB_CANCEL_INVOKE = BIT(0),
     81};
     82
     83#define TPM_CRB_NO_LOCALITY 0xff
     84
     85static uint64_t tpm_crb_mmio_read(void *opaque, hwaddr addr,
     86                                  unsigned size)
     87{
     88    CRBState *s = CRB(opaque);
     89    void *regs = (void *)&s->regs + (addr & ~3);
     90    unsigned offset = addr & 3;
     91    uint32_t val = *(uint32_t *)regs >> (8 * offset);
     92
     93    switch (addr) {
     94    case A_CRB_LOC_STATE:
     95        val |= !tpm_backend_get_tpm_established_flag(s->tpmbe);
     96        break;
     97    }
     98
     99    trace_tpm_crb_mmio_read(addr, size, val);
    100
    101    return val;
    102}
    103
    104static uint8_t tpm_crb_get_active_locty(CRBState *s)
    105{
    106    if (!ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, locAssigned)) {
    107        return TPM_CRB_NO_LOCALITY;
    108    }
    109    return ARRAY_FIELD_EX32(s->regs, CRB_LOC_STATE, activeLocality);
    110}
    111
    112static void tpm_crb_mmio_write(void *opaque, hwaddr addr,
    113                               uint64_t val, unsigned size)
    114{
    115    CRBState *s = CRB(opaque);
    116    uint8_t locty =  addr >> 12;
    117
    118    trace_tpm_crb_mmio_write(addr, size, val);
    119
    120    switch (addr) {
    121    case A_CRB_CTRL_REQ:
    122        switch (val) {
    123        case CRB_CTRL_REQ_CMD_READY:
    124            ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
    125                             tpmIdle, 0);
    126            break;
    127        case CRB_CTRL_REQ_GO_IDLE:
    128            ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
    129                             tpmIdle, 1);
    130            break;
    131        }
    132        break;
    133    case A_CRB_CTRL_CANCEL:
    134        if (val == CRB_CANCEL_INVOKE &&
    135            s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) {
    136            tpm_backend_cancel_cmd(s->tpmbe);
    137        }
    138        break;
    139    case A_CRB_CTRL_START:
    140        if (val == CRB_START_INVOKE &&
    141            !(s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) &&
    142            tpm_crb_get_active_locty(s) == locty) {
    143            void *mem = memory_region_get_ram_ptr(&s->cmdmem);
    144
    145            s->regs[R_CRB_CTRL_START] |= CRB_START_INVOKE;
    146            s->cmd = (TPMBackendCmd) {
    147                .in = mem,
    148                .in_len = MIN(tpm_cmd_get_size(mem), s->be_buffer_size),
    149                .out = mem,
    150                .out_len = s->be_buffer_size,
    151            };
    152
    153            tpm_backend_deliver_request(s->tpmbe, &s->cmd);
    154        }
    155        break;
    156    case A_CRB_LOC_CTRL:
    157        switch (val) {
    158        case CRB_LOC_CTRL_RESET_ESTABLISHMENT_BIT:
    159            /* not loc 3 or 4 */
    160            break;
    161        case CRB_LOC_CTRL_RELINQUISH:
    162            ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
    163                             locAssigned, 0);
    164            ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
    165                             Granted, 0);
    166            break;
    167        case CRB_LOC_CTRL_REQUEST_ACCESS:
    168            ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
    169                             Granted, 1);
    170            ARRAY_FIELD_DP32(s->regs, CRB_LOC_STS,
    171                             beenSeized, 0);
    172            ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
    173                             locAssigned, 1);
    174            break;
    175        }
    176        break;
    177    }
    178}
    179
    180static const MemoryRegionOps tpm_crb_memory_ops = {
    181    .read = tpm_crb_mmio_read,
    182    .write = tpm_crb_mmio_write,
    183    .endianness = DEVICE_LITTLE_ENDIAN,
    184    .valid = {
    185        .min_access_size = 1,
    186        .max_access_size = 4,
    187    },
    188};
    189
    190static void tpm_crb_request_completed(TPMIf *ti, int ret)
    191{
    192    CRBState *s = CRB(ti);
    193
    194    s->regs[R_CRB_CTRL_START] &= ~CRB_START_INVOKE;
    195    if (ret != 0) {
    196        ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
    197                         tpmSts, 1); /* fatal error */
    198    }
    199}
    200
    201static enum TPMVersion tpm_crb_get_version(TPMIf *ti)
    202{
    203    CRBState *s = CRB(ti);
    204
    205    return tpm_backend_get_tpm_version(s->tpmbe);
    206}
    207
    208static int tpm_crb_pre_save(void *opaque)
    209{
    210    CRBState *s = opaque;
    211
    212    tpm_backend_finish_sync(s->tpmbe);
    213
    214    return 0;
    215}
    216
    217static const VMStateDescription vmstate_tpm_crb = {
    218    .name = "tpm-crb",
    219    .pre_save = tpm_crb_pre_save,
    220    .fields = (VMStateField[]) {
    221        VMSTATE_UINT32_ARRAY(regs, CRBState, TPM_CRB_R_MAX),
    222        VMSTATE_END_OF_LIST(),
    223    }
    224};
    225
    226static Property tpm_crb_properties[] = {
    227    DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe),
    228    DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true),
    229    DEFINE_PROP_END_OF_LIST(),
    230};
    231
    232static void tpm_crb_reset(void *dev)
    233{
    234    CRBState *s = CRB(dev);
    235
    236    if (s->ppi_enabled) {
    237        tpm_ppi_reset(&s->ppi);
    238    }
    239    tpm_backend_reset(s->tpmbe);
    240
    241    memset(s->regs, 0, sizeof(s->regs));
    242
    243    ARRAY_FIELD_DP32(s->regs, CRB_LOC_STATE,
    244                     tpmRegValidSts, 1);
    245    ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS,
    246                     tpmIdle, 1);
    247    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    248                     InterfaceType, CRB_INTF_TYPE_CRB_ACTIVE);
    249    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    250                     InterfaceVersion, CRB_INTF_VERSION_CRB);
    251    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    252                     CapLocality, CRB_INTF_CAP_LOCALITY_0_ONLY);
    253    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    254                     CapCRBIdleBypass, CRB_INTF_CAP_IDLE_FAST);
    255    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    256                     CapDataXferSizeSupport, CRB_INTF_CAP_XFER_SIZE_64);
    257    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    258                     CapFIFO, CRB_INTF_CAP_FIFO_NOT_SUPPORTED);
    259    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    260                     CapCRB, CRB_INTF_CAP_CRB_SUPPORTED);
    261    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    262                     InterfaceSelector, CRB_INTF_IF_SELECTOR_CRB);
    263    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID,
    264                     RID, 0b0000);
    265    ARRAY_FIELD_DP32(s->regs, CRB_INTF_ID2,
    266                     VID, PCI_VENDOR_ID_IBM);
    267
    268    s->regs[R_CRB_CTRL_CMD_SIZE] = CRB_CTRL_CMD_SIZE;
    269    s->regs[R_CRB_CTRL_CMD_LADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
    270    s->regs[R_CRB_CTRL_RSP_SIZE] = CRB_CTRL_CMD_SIZE;
    271    s->regs[R_CRB_CTRL_RSP_ADDR] = TPM_CRB_ADDR_BASE + A_CRB_DATA_BUFFER;
    272
    273    s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->tpmbe),
    274                            CRB_CTRL_CMD_SIZE);
    275
    276    if (tpm_backend_startup_tpm(s->tpmbe, s->be_buffer_size) < 0) {
    277        exit(1);
    278    }
    279}
    280
    281static void tpm_crb_realize(DeviceState *dev, Error **errp)
    282{
    283    CRBState *s = CRB(dev);
    284
    285    if (!tpm_find()) {
    286        error_setg(errp, "at most one TPM device is permitted");
    287        return;
    288    }
    289    if (!s->tpmbe) {
    290        error_setg(errp, "'tpmdev' property is required");
    291        return;
    292    }
    293
    294    memory_region_init_io(&s->mmio, OBJECT(s), &tpm_crb_memory_ops, s,
    295        "tpm-crb-mmio", sizeof(s->regs));
    296    memory_region_init_ram(&s->cmdmem, OBJECT(s),
    297        "tpm-crb-cmd", CRB_CTRL_CMD_SIZE, errp);
    298
    299    memory_region_add_subregion(get_system_memory(),
    300        TPM_CRB_ADDR_BASE, &s->mmio);
    301    memory_region_add_subregion(get_system_memory(),
    302        TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem);
    303
    304    if (s->ppi_enabled) {
    305        tpm_ppi_init(&s->ppi, get_system_memory(),
    306                     TPM_PPI_ADDR_BASE, OBJECT(s));
    307    }
    308
    309    qemu_register_reset(tpm_crb_reset, dev);
    310}
    311
    312static void tpm_crb_class_init(ObjectClass *klass, void *data)
    313{
    314    DeviceClass *dc = DEVICE_CLASS(klass);
    315    TPMIfClass *tc = TPM_IF_CLASS(klass);
    316
    317    dc->realize = tpm_crb_realize;
    318    device_class_set_props(dc, tpm_crb_properties);
    319    dc->vmsd  = &vmstate_tpm_crb;
    320    dc->user_creatable = true;
    321    tc->model = TPM_MODEL_TPM_CRB;
    322    tc->get_version = tpm_crb_get_version;
    323    tc->request_completed = tpm_crb_request_completed;
    324
    325    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
    326}
    327
    328static const TypeInfo tpm_crb_info = {
    329    .name = TYPE_TPM_CRB,
    330    /* could be TYPE_SYS_BUS_DEVICE (or LPC etc) */
    331    .parent = TYPE_DEVICE,
    332    .instance_size = sizeof(CRBState),
    333    .class_init  = tpm_crb_class_init,
    334    .interfaces = (InterfaceInfo[]) {
    335        { TYPE_TPM_IF },
    336        { }
    337    }
    338};
    339
    340static void tpm_crb_register(void)
    341{
    342    type_register_static(&tpm_crb_info);
    343}
    344
    345type_init(tpm_crb_register)