2 * Copyright (c) 2013 Google, Inc
4 * SPDX-License-Identifier: GPL-2.0+
9 #include <asm/unaligned.h>
10 #include <linux/crc8.h>
12 /* TPM NVRAM location indices. */
13 #define FIRMWARE_NV_INDEX 0x1007
14 #define KERNEL_NV_INDEX 0x1008
16 #define NV_DATA_PUBLIC_PERMISSIONS_OFFSET 60
18 /* Kernel TPM space - KERNEL_NV_INDEX, locked with physical presence */
19 #define ROLLBACK_SPACE_KERNEL_VERSION 2
20 #define ROLLBACK_SPACE_KERNEL_UID 0x4752574C /* 'GRWL' */
22 struct rollback_space_kernel
{
23 /* Struct version, for backwards compatibility */
24 uint8_t struct_version
;
25 /* Unique ID to detect space redefinition */
28 uint32_t kernel_versions
;
29 /* Reserved for future expansion */
31 /* Checksum (v2 and later only) */
33 } __packed rollback_space_kernel
;
36 * These numbers derive from adding the sizes of command fields as shown in
37 * the TPM commands manual.
39 #define TPM_REQUEST_HEADER_LENGTH 10
40 #define TPM_RESPONSE_HEADER_LENGTH 10
42 /* These are the different non-volatile spaces that we emulate */
50 /* Size of each non-volatile space */
51 #define NV_DATA_SIZE 0x20
54 * Information about our TPM emulation. This is preserved in the sandbox
55 * state file if enabled.
57 static struct tpm_state
{
58 uint8_t nvdata
[NV_SEQ_COUNT
][NV_DATA_SIZE
];
62 * sandbox_tpm_read_state() - read the sandbox EC state from the state file
64 * If data is available, then blob and node will provide access to it. If
65 * not this function sets up an empty TPM.
67 * @blob: Pointer to device tree blob, or NULL if no data to read
68 * @node: Node offset to read from
70 static int sandbox_tpm_read_state(const void *blob
, int node
)
79 for (i
= 0; i
< NV_SEQ_COUNT
; i
++) {
82 sprintf(prop_name
, "nvdata%d", i
);
83 prop
= fdt_getprop(blob
, node
, prop_name
, &len
);
84 if (prop
&& len
== NV_DATA_SIZE
)
85 memcpy(state
.nvdata
[i
], prop
, NV_DATA_SIZE
);
92 * cros_ec_write_state() - Write out our state to the state file
94 * The caller will ensure that there is a node ready for the state. The node
95 * may already contain the old state, in which case it is overridden.
97 * @blob: Device tree blob holding state
98 * @node: Node to write our state into
100 static int sandbox_tpm_write_state(void *blob
, int node
)
105 * We are guaranteed enough space to write basic properties.
106 * We could use fdt_add_subnode() to put each set of data in its
107 * own node - perhaps useful if we add access informaiton to each.
109 for (i
= 0; i
< NV_SEQ_COUNT
; i
++) {
112 sprintf(prop_name
, "nvdata%d", i
);
113 fdt_setprop(blob
, node
, prop_name
, state
.nvdata
[i
],
120 SANDBOX_STATE_IO(sandbox_tpm
, "google,sandbox-tpm", sandbox_tpm_read_state
,
121 sandbox_tpm_write_state
);
123 static int index_to_seq(uint32_t index
)
126 case FIRMWARE_NV_INDEX
:
127 return NV_SEQ_FIRMWARE
;
128 case KERNEL_NV_INDEX
:
129 return NV_SEQ_KERNEL
;
131 return NV_GLOBAL_LOCK
;
134 printf("Invalid nv index %#x\n", index
);
138 int tis_sendrecv(const u8
*sendbuf
, size_t send_size
,
139 u8
*recvbuf
, size_t *recv_len
)
141 struct tpm_state
*tpm
= &state
;
142 uint32_t code
, index
, length
, type
;
146 code
= get_unaligned_be32(sendbuf
+ sizeof(uint16_t) +
148 printf("tpm: %zd bytes, recv_len %zd, cmd = %x\n", send_size
,
150 print_buffer(0, sendbuf
, 1, send_size
, 0);
152 case 0x65: /* get flags */
153 type
= get_unaligned_be32(sendbuf
+ 14);
156 index
= get_unaligned_be32(sendbuf
+ 18);
157 printf("Get flags index %#02x\n", index
);
159 memset(recvbuf
, '\0', *recv_len
);
160 put_unaligned_be32(22, recvbuf
+
161 TPM_RESPONSE_HEADER_LENGTH
);
162 data
= recvbuf
+ TPM_RESPONSE_HEADER_LENGTH
+
165 case FIRMWARE_NV_INDEX
:
167 case KERNEL_NV_INDEX
:
168 /* TPM_NV_PER_PPWRITE */
169 put_unaligned_be32(1, data
+
170 NV_DATA_PUBLIC_PERMISSIONS_OFFSET
);
174 case 0x11: /* TPM_CAP_NV_INDEX */
175 index
= get_unaligned_be32(sendbuf
+ 18);
176 printf("Get cap nv index %#02x\n", index
);
177 put_unaligned_be32(22, recvbuf
+
178 TPM_RESPONSE_HEADER_LENGTH
);
181 printf(" ** Unknown 0x65 command type %#02x\n",
186 case 0xcd: /* nvwrite */
187 index
= get_unaligned_be32(sendbuf
+ 10);
188 length
= get_unaligned_be32(sendbuf
+ 18);
189 seq
= index_to_seq(index
);
192 printf("tpm: nvwrite index=%#02x, len=%#02x\n", index
, length
);
193 memcpy(&tpm
->nvdata
[seq
], sendbuf
+ 22, length
);
195 memset(recvbuf
, '\0', *recv_len
);
197 case 0xcf: /* nvread */
198 index
= get_unaligned_be32(sendbuf
+ 10);
199 length
= get_unaligned_be32(sendbuf
+ 18);
200 seq
= index_to_seq(index
);
203 printf("tpm: nvread index=%#02x, len=%#02x\n", index
, length
);
204 *recv_len
= TPM_RESPONSE_HEADER_LENGTH
+ sizeof(uint32_t) +
206 memset(recvbuf
, '\0', *recv_len
);
207 put_unaligned_be32(length
, recvbuf
+
208 TPM_RESPONSE_HEADER_LENGTH
);
209 if (seq
== NV_SEQ_KERNEL
) {
210 struct rollback_space_kernel rsk
;
212 data
= recvbuf
+ TPM_RESPONSE_HEADER_LENGTH
+
214 rsk
.struct_version
= 2;
215 rsk
.uid
= ROLLBACK_SPACE_KERNEL_UID
;
216 rsk
.kernel_versions
= 0;
217 rsk
.crc8
= crc8((unsigned char *)&rsk
,
218 offsetof(struct rollback_space_kernel
,
220 memcpy(data
, &rsk
, sizeof(rsk
));
222 memcpy(recvbuf
+ TPM_RESPONSE_HEADER_LENGTH
+
223 sizeof(uint32_t), &tpm
->nvdata
[seq
], length
);
226 case 0x14: /* tpm extend */
227 case 0x15: /* pcr read */
228 case 0x5d: /* force clear */
229 case 0x6f: /* physical enable */
230 case 0x72: /* physical set deactivated */
231 case 0x99: /* startup */
232 case 0x4000000a: /* assert physical presence */
234 memset(recvbuf
, '\0', *recv_len
);
237 printf("Unknown tpm command %02x\n", code
);
246 printf("%s\n", __func__
);
252 printf("%s\n", __func__
);
258 printf("%s\n", __func__
);