From nobody Mon Feb 9 22:10:34 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1530016104810947.1646815861387; Tue, 26 Jun 2018 05:28:24 -0700 (PDT) Received: from localhost ([::1]:52403 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXn56-0006PB-3G for importer@patchew.org; Tue, 26 Jun 2018 08:28:24 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44268) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXn0h-00034y-9G for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fXn0g-0008Hp-C9 for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:51 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:48530 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fXn0g-0008Hk-7w for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:50 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D33565BCD5; Tue, 26 Jun 2018 12:23:49 +0000 (UTC) Received: from localhost (ovpn-112-41.ams2.redhat.com [10.36.112.41]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3BA121117626; Tue, 26 Jun 2018 12:23:46 +0000 (UTC) From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= To: qemu-devel@nongnu.org Date: Tue, 26 Jun 2018 14:23:40 +0200 Message-Id: <20180626122343.13473-2-marcandre.lureau@redhat.com> In-Reply-To: <20180626122343.13473-1-marcandre.lureau@redhat.com> References: <20180626122343.13473-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Tue, 26 Jun 2018 12:23:49 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Tue, 26 Jun 2018 12:23:49 +0000 (UTC) for IP:'10.11.54.3' DOMAIN:'int-mx03.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'marcandre.lureau@redhat.com' RCPT:'' Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v5 1/4] tpm: add a "ppi" boolean property X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , "Michael S. Tsirkin" , stefanb@linux.vnet.ibm.com, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Igor Mammedov , Paolo Bonzini , Richard Henderson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" The following patches implement the TPM Physical Presence Interface, make use of a new memory region and a fw_cfg entry. Enable PPI by default with >2.12 machine type, to avoid migration issues. Signed-off-by: Marc-Andr=C3=A9 Lureau Reviewed-by: Igor Mammedov --- include/hw/compat.h | 10 ++++++++++ hw/tpm/tpm_crb.c | 3 +++ hw/tpm/tpm_tis.c | 3 +++ 3 files changed, 16 insertions(+) diff --git a/include/hw/compat.h b/include/hw/compat.h index 44d5964060..01758991a0 100644 --- a/include/hw/compat.h +++ b/include/hw/compat.h @@ -2,6 +2,16 @@ #define HW_COMPAT_H =20 #define HW_COMPAT_2_12 \ + {\ + .driver =3D "tpm-crb",\ + .property =3D "ppi",\ + .value =3D "false",\ + },\ + {\ + .driver =3D "tpm-tis",\ + .property =3D "ppi",\ + .value =3D "false",\ + },\ {\ .driver =3D "migration",\ .property =3D "decompress-error-check",\ diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index a92dd50437..d5b0ac5920 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -41,6 +41,8 @@ typedef struct CRBState { MemoryRegion cmdmem; =20 size_t be_buffer_size; + + bool ppi_enabled; } CRBState; =20 #define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB) @@ -221,6 +223,7 @@ static const VMStateDescription vmstate_tpm_crb =3D { =20 static Property tpm_crb_properties[] =3D { DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe), + DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true), DEFINE_PROP_END_OF_LIST(), }; =20 diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c index 12f5c9a759..d9ddf9b723 100644 --- a/hw/tpm/tpm_tis.c +++ b/hw/tpm/tpm_tis.c @@ -81,6 +81,8 @@ typedef struct TPMState { TPMVersion be_tpm_version; =20 size_t be_buffer_size; + + bool ppi_enabled; } TPMState; =20 #define TPM(obj) OBJECT_CHECK(TPMState, (obj), TYPE_TPM_TIS) @@ -950,6 +952,7 @@ static const VMStateDescription vmstate_tpm_tis =3D { static Property tpm_tis_properties[] =3D { DEFINE_PROP_UINT32("irq", TPMState, irq_num, TPM_TIS_IRQ), DEFINE_PROP_TPMBE("tpmdev", TPMState, be_driver), + DEFINE_PROP_BOOL("ppi", TPMState, ppi_enabled, true), DEFINE_PROP_END_OF_LIST(), }; =20 --=20 2.18.0.rc1 From nobody Mon Feb 9 22:10:34 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1530015958329943.8666099985816; Tue, 26 Jun 2018 05:25:58 -0700 (PDT) Received: from localhost ([::1]:52384 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXn2j-0004Dy-D7 for importer@patchew.org; Tue, 26 Jun 2018 08:25:57 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44280) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXn0j-00036K-Ci for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fXn0h-0008IB-Vu for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:53 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:35452 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fXn0h-0008I6-QG for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:51 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6289F81A4EA4; Tue, 26 Jun 2018 12:23:51 +0000 (UTC) Received: from localhost (ovpn-112-41.ams2.redhat.com [10.36.112.41]) by smtp.corp.redhat.com (Postfix) with ESMTP id E131E2166B5D; Tue, 26 Jun 2018 12:23:50 +0000 (UTC) From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= To: qemu-devel@nongnu.org Date: Tue, 26 Jun 2018 14:23:41 +0200 Message-Id: <20180626122343.13473-3-marcandre.lureau@redhat.com> In-Reply-To: <20180626122343.13473-1-marcandre.lureau@redhat.com> References: <20180626122343.13473-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.8]); Tue, 26 Jun 2018 12:23:51 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.8]); Tue, 26 Jun 2018 12:23:51 +0000 (UTC) for IP:'10.11.54.6' DOMAIN:'int-mx06.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'marcandre.lureau@redhat.com' RCPT:'' Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v5 2/4] tpm: implement virtual memory device for TPM PPI X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , "Michael S. Tsirkin" , stefanb@linux.vnet.ibm.com, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Igor Mammedov , Paolo Bonzini , Richard Henderson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" From: Stefan Berger Implement a virtual memory device for the TPM Physical Presence interface. The memory is located at 0xFED45000 and used by ACPI to send messages to the firmware (BIOS) and by the firmware to provide parameters for each one of the supported codes. This device should be used by all TPM interfaces on x86 and can be added by calling tpm_ppi_init_io(). Signed-off-by: Stefan Berger Signed-off-by: Marc-Andr=C3=A9 Lureau --- v4 (Marc-Andr=C3=A9): - pass TPM_PPI_ADDR_BASE as argument to tpm_ppi_init_io() - only enable PPI if property is set v3 (Marc-Andr=C3=A9): - merge CRB support - use trace events instead of DEBUG printf - headers inclusion simplification v2: - moved to byte access since an infrequently used device; this simplifies code - increase size of device to 0x400 - move device to 0xfffef000 since SeaBIOS has some code at 0xffff0000: 'On the emulators, the bios at 0xf0000 is also at 0xffff0000' --- hw/tpm/tpm_ppi.h | 27 ++++++++++++++++++++ include/hw/acpi/tpm.h | 6 +++++ hw/tpm/tpm_crb.c | 7 ++++++ hw/tpm/tpm_ppi.c | 57 +++++++++++++++++++++++++++++++++++++++++++ hw/tpm/tpm_tis.c | 7 ++++++ hw/tpm/Makefile.objs | 2 +- hw/tpm/trace-events | 4 +++ 7 files changed, 109 insertions(+), 1 deletion(-) create mode 100644 hw/tpm/tpm_ppi.h create mode 100644 hw/tpm/tpm_ppi.c diff --git a/hw/tpm/tpm_ppi.h b/hw/tpm/tpm_ppi.h new file mode 100644 index 0000000000..ac7ad47238 --- /dev/null +++ b/hw/tpm/tpm_ppi.h @@ -0,0 +1,27 @@ +/* + * TPM Physical Presence Interface + * + * Copyright (C) 2018 IBM Corporation + * + * Authors: + * Stefan Berger + * + * This work is licensed under the terms of the GNU GPL, version 2 or late= r. + * See the COPYING file in the top-level directory. + */ +#ifndef TPM_TPM_PPI_H +#define TPM_TPM_PPI_H + +#include "hw/acpi/tpm.h" +#include "exec/address-spaces.h" + +typedef struct TPMPPI { + MemoryRegion mmio; + + uint8_t ram[TPM_PPI_ADDR_SIZE]; +} TPMPPI; + +void tpm_ppi_init_io(TPMPPI *tpmppi, struct MemoryRegion *m, + hwaddr addr, Object *obj); + +#endif /* TPM_TPM_PPI_H */ diff --git a/include/hw/acpi/tpm.h b/include/hw/acpi/tpm.h index 46ac4dc581..c082df7d1d 100644 --- a/include/hw/acpi/tpm.h +++ b/include/hw/acpi/tpm.h @@ -187,4 +187,10 @@ REG32(CRB_DATA_BUFFER, 0x80) #define TPM2_START_METHOD_MMIO 6 #define TPM2_START_METHOD_CRB 7 =20 +/* + * Physical Presence Interface + */ +#define TPM_PPI_ADDR_SIZE 0x400 +#define TPM_PPI_ADDR_BASE 0xFED45000 + #endif /* HW_ACPI_TPM_H */ diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index d5b0ac5920..37c095f00f 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -29,6 +29,7 @@ #include "sysemu/reset.h" #include "tpm_int.h" #include "tpm_util.h" +#include "tpm_ppi.h" #include "trace.h" =20 typedef struct CRBState { @@ -43,6 +44,7 @@ typedef struct CRBState { size_t be_buffer_size; =20 bool ppi_enabled; + TPMPPI ppi; } CRBState; =20 #define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB) @@ -294,6 +296,11 @@ static void tpm_crb_realize(DeviceState *dev, Error **= errp) memory_region_add_subregion(get_system_memory(), TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem); =20 + if (s->ppi_enabled) { + tpm_ppi_init_io(&s->ppi, get_system_memory(), + TPM_PPI_ADDR_BASE, OBJECT(s)); + } + qemu_register_reset(tpm_crb_reset, dev); } =20 diff --git a/hw/tpm/tpm_ppi.c b/hw/tpm/tpm_ppi.c new file mode 100644 index 0000000000..79bec186c7 --- /dev/null +++ b/hw/tpm/tpm_ppi.c @@ -0,0 +1,57 @@ +/* + * tpm_ppi.c - TPM Physical Presence Interface + * + * Copyright (C) 2018 IBM Corporation + * + * Authors: + * Stefan Berger + * + * This work is licensed under the terms of the GNU GPL, version 2 or late= r. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" + +#include "tpm_ppi.h" +#include "trace.h" + +static uint64_t tpm_ppi_mmio_read(void *opaque, hwaddr addr, + unsigned size) +{ + TPMPPI *s =3D opaque; + + trace_tpm_ppi_mmio_read(addr, size, s->ram[addr]); + + return s->ram[addr]; +} + +static void tpm_ppi_mmio_write(void *opaque, hwaddr addr, + uint64_t val, unsigned size) +{ + TPMPPI *s =3D opaque; + + trace_tpm_ppi_mmio_write(addr, size, val); + + s->ram[addr] =3D val; +} + +static const MemoryRegionOps tpm_ppi_memory_ops =3D { + .read =3D tpm_ppi_mmio_read, + .write =3D tpm_ppi_mmio_write, + .endianness =3D DEVICE_NATIVE_ENDIAN, + .valid =3D { + .min_access_size =3D 1, + .max_access_size =3D 1, + }, +}; + +void tpm_ppi_init_io(TPMPPI *tpmppi, struct MemoryRegion *m, + hwaddr addr, Object *obj) +{ + memory_region_init_io(&tpmppi->mmio, obj, &tpm_ppi_memory_ops, + tpmppi, "tpm-ppi-mmio", + TPM_PPI_ADDR_SIZE); + + memory_region_add_subregion(m, addr, &tpmppi->mmio); +} diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c index d9ddf9b723..e7f45a05b9 100644 --- a/hw/tpm/tpm_tis.c +++ b/hw/tpm/tpm_tis.c @@ -31,6 +31,7 @@ #include "sysemu/tpm_backend.h" #include "tpm_int.h" #include "tpm_util.h" +#include "tpm_ppi.h" #include "trace.h" =20 #define TPM_TIS_NUM_LOCALITIES 5 /* per spec */ @@ -83,6 +84,7 @@ typedef struct TPMState { size_t be_buffer_size; =20 bool ppi_enabled; + TPMPPI ppi; } TPMState; =20 #define TPM(obj) OBJECT_CHECK(TPMState, (obj), TYPE_TPM_TIS) @@ -979,6 +981,11 @@ static void tpm_tis_realizefn(DeviceState *dev, Error = **errp) =20 memory_region_add_subregion(isa_address_space(ISA_DEVICE(dev)), TPM_TIS_ADDR_BASE, &s->mmio); + + if (s->ppi_enabled) { + tpm_ppi_init_io(&s->ppi, isa_address_space(ISA_DEVICE(dev)), + TPM_PPI_ADDR_BASE, OBJECT(s)); + } } =20 static void tpm_tis_initfn(Object *obj) diff --git a/hw/tpm/Makefile.objs b/hw/tpm/Makefile.objs index 1dc9f8bf2c..eedd8b6858 100644 --- a/hw/tpm/Makefile.objs +++ b/hw/tpm/Makefile.objs @@ -1,4 +1,4 @@ -common-obj-y +=3D tpm_util.o +common-obj-y +=3D tpm_util.o tpm_ppi.o common-obj-$(CONFIG_TPM_TIS) +=3D tpm_tis.o common-obj-$(CONFIG_TPM_CRB) +=3D tpm_crb.o common-obj-$(CONFIG_TPM_PASSTHROUGH) +=3D tpm_passthrough.o diff --git a/hw/tpm/trace-events b/hw/tpm/trace-events index 25bee0cecf..81f9923401 100644 --- a/hw/tpm/trace-events +++ b/hw/tpm/trace-events @@ -8,6 +8,10 @@ tpm_crb_mmio_write(uint64_t addr, unsigned size, uint32_t = val) "CRB write 0x" TA tpm_passthrough_handle_request(void *cmd) "processing command %p" tpm_passthrough_reset(void) "reset" =20 +# hw/tpm/tpm_ppi.c +tpm_ppi_mmio_read(uint64_t addr, unsigned size, uint32_t val) "PPI read 0x= " TARGET_FMT_plx " len:%u val: 0x%" PRIx32 +tpm_ppi_mmio_write(uint64_t addr, unsigned size, uint32_t val) "PPI write = 0x" TARGET_FMT_plx " len:%u val: 0x%" PRIx32 + # hw/tpm/tpm_util.c tpm_util_get_buffer_size_hdr_len(uint32_t len, size_t expected) "tpm_resp-= >hdr.len =3D %u, expected =3D %zu" tpm_util_get_buffer_size_len(uint32_t len, size_t expected) "tpm_resp->len= =3D %u, expected =3D %zu" --=20 2.18.0.rc1 From nobody Mon Feb 9 22:10:34 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1530015957722465.3736081009905; Tue, 26 Jun 2018 05:25:57 -0700 (PDT) Received: from localhost ([::1]:52383 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXn2i-0004Di-Vv for importer@patchew.org; Tue, 26 Jun 2018 08:25:57 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44293) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXn0k-00036Z-H4 for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fXn0j-0008IY-He for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:54 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:38208 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fXn0j-0008IL-Bh for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:53 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id EEB44401C96B; Tue, 26 Jun 2018 12:23:52 +0000 (UTC) Received: from localhost (ovpn-112-41.ams2.redhat.com [10.36.112.41]) by smtp.corp.redhat.com (Postfix) with ESMTP id 713B22166B5D; Tue, 26 Jun 2018 12:23:52 +0000 (UTC) From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= To: qemu-devel@nongnu.org Date: Tue, 26 Jun 2018 14:23:42 +0200 Message-Id: <20180626122343.13473-4-marcandre.lureau@redhat.com> In-Reply-To: <20180626122343.13473-1-marcandre.lureau@redhat.com> References: <20180626122343.13473-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.5]); Tue, 26 Jun 2018 12:23:53 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.5]); Tue, 26 Jun 2018 12:23:53 +0000 (UTC) for IP:'10.11.54.6' DOMAIN:'int-mx06.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'marcandre.lureau@redhat.com' RCPT:'' Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v5 3/4] acpi: add fw_cfg file for TPM and PPI virtual memory device X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , "Michael S. Tsirkin" , stefanb@linux.vnet.ibm.com, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Igor Mammedov , Paolo Bonzini , Richard Henderson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" From: Stefan Berger To avoid having to hard code the base address of the PPI virtual memory device we introduce a fw_cfg file etc/tpm/config that holds the base address of the PPI device, the version of the PPI interface and the version of the attached TPM. Signed-off-by: Stefan Berger [ Marc-Andr=C3=A9: renamed to etc/tpm/config, made it static, document it ] Signed-off-by: Marc-Andr=C3=A9 Lureau --- v4: - add ACPI only if PPI is enabled v3: - renamed to etc/tpm/config, made it static, document it --- include/hw/acpi/tpm.h | 3 +++ hw/i386/acpi-build.c | 19 +++++++++++++++++++ docs/specs/tpm.txt | 20 ++++++++++++++++++++ 3 files changed, 42 insertions(+) diff --git a/include/hw/acpi/tpm.h b/include/hw/acpi/tpm.h index c082df7d1d..f79d68a77a 100644 --- a/include/hw/acpi/tpm.h +++ b/include/hw/acpi/tpm.h @@ -193,4 +193,7 @@ REG32(CRB_DATA_BUFFER, 0x80) #define TPM_PPI_ADDR_SIZE 0x400 #define TPM_PPI_ADDR_BASE 0xFED45000 =20 +#define TPM_PPI_VERSION_NONE 0 +#define TPM_PPI_VERSION_1_30 1 + #endif /* HW_ACPI_TPM_H */ diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c index 9bc6d97ea1..d9320845ed 100644 --- a/hw/i386/acpi-build.c +++ b/hw/i386/acpi-build.c @@ -119,6 +119,12 @@ typedef struct AcpiBuildPciBusHotplugState { bool pcihp_bridge_en; } AcpiBuildPciBusHotplugState; =20 +typedef struct FWCfgTPMConfig { + uint32_t tpmppi_address; + uint8_t tpm_version; + uint8_t tpmppi_version; +} QEMU_PACKED FWCfgTPMConfig; + static void init_common_fadt_data(Object *o, AcpiFadtData *data) { uint32_t io =3D object_property_get_uint(o, ACPI_PM_PROP_PM_IO_BASE, N= ULL); @@ -2873,6 +2879,8 @@ void acpi_setup(void) AcpiBuildTables tables; AcpiBuildState *build_state; Object *vmgenid_dev; + TPMIf *tpm; + static FWCfgTPMConfig tpm_config; =20 if (!pcms->fw_cfg) { ACPI_BUILD_DPRINTF("No fw cfg. Bailing out.\n"); @@ -2907,6 +2915,17 @@ void acpi_setup(void) fw_cfg_add_file(pcms->fw_cfg, ACPI_BUILD_TPMLOG_FILE, tables.tcpalog->data, acpi_data_len(tables.tcpalog)); =20 + tpm =3D tpm_find(); + if (tpm && object_property_get_bool(OBJECT(tpm), "ppi", &error_abort))= { + tpm_config =3D (FWCfgTPMConfig) { + .tpmppi_address =3D cpu_to_le32(TPM_PPI_ADDR_BASE), + .tpm_version =3D cpu_to_le32(tpm_get_version(tpm_find())), + .tpmppi_version =3D cpu_to_le32(TPM_PPI_VERSION_NONE) + }; + fw_cfg_add_file(pcms->fw_cfg, "etc/tpm/config", + &tpm_config, sizeof tpm_config); + } + vmgenid_dev =3D find_vmgenid_dev(); if (vmgenid_dev) { vmgenid_add_fw_cfg(VMGENID(vmgenid_dev), pcms->fw_cfg, diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt index c230c4c93e..2ddb768084 100644 --- a/docs/specs/tpm.txt +++ b/docs/specs/tpm.txt @@ -20,6 +20,26 @@ QEMU files related to TPM TIS interface: - hw/tpm/tpm_tis.h =20 =20 +=3D fw_cfg interface =3D + +The bios/firmware may use the "etc/tpm/config" fw_cfg entry for +configuring the guest appropriately. + +The entry of 6 bytes has the following content, in little-endian: + + #define TPM_VERSION_UNSPEC 0 + #define TPM_VERSION_1_2 1 + #define TPM_VERSION_2_0 2 + + #define TPM_PPI_VERSION_NONE 0 + #define TPM_PPI_VERSION_1_30 1 + + struct FWCfgTPMConfig { + uint32_t tpmppi_address; /* PPI memory location */ + uint8_t tpm_version; /* TPM version */ + uint8_t tpmppi_version; /* PPI version */ + }; + =3D ACPI Interface =3D =20 The TPM device is defined with ACPI ID "PNP0C31". QEMU builds a SSDT and p= asses --=20 2.18.0.rc1 From nobody Mon Feb 9 22:10:34 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1530016118777487.87968426227644; Tue, 26 Jun 2018 05:28:38 -0700 (PDT) Received: from localhost ([::1]:52404 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXn5K-0006ZY-05 for importer@patchew.org; Tue, 26 Jun 2018 08:28:38 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44309) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fXn0o-00038U-KJ for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:24:01 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fXn0l-0008Iw-CS for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:58 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:49402 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fXn0l-0008Io-4Q for qemu-devel@nongnu.org; Tue, 26 Jun 2018 08:23:55 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B4DE57A7E8; Tue, 26 Jun 2018 12:23:54 +0000 (UTC) Received: from localhost (ovpn-112-41.ams2.redhat.com [10.36.112.41]) by smtp.corp.redhat.com (Postfix) with ESMTP id 11F0E1117626; Tue, 26 Jun 2018 12:23:53 +0000 (UTC) From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= To: qemu-devel@nongnu.org Date: Tue, 26 Jun 2018 14:23:43 +0200 Message-Id: <20180626122343.13473-5-marcandre.lureau@redhat.com> In-Reply-To: <20180626122343.13473-1-marcandre.lureau@redhat.com> References: <20180626122343.13473-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Tue, 26 Jun 2018 12:23:54 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Tue, 26 Jun 2018 12:23:54 +0000 (UTC) for IP:'10.11.54.3' DOMAIN:'int-mx03.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'marcandre.lureau@redhat.com' RCPT:'' Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v5 4/4] acpi: build TPM Physical Presence interface X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , "Michael S. Tsirkin" , stefanb@linux.vnet.ibm.com, Igor Mammedov , Paolo Bonzini , Richard Henderson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" From: Stefan Berger The TPM Physical Presence interface consists of an ACPI part, a shared memory part, and code in the firmware. Users can send messages to the firmware by writing a code into the shared memory through invoking the ACPI code. When a reboot happens, the firmware looks for the code and acts on it by sending sequences of commands to the TPM. This patch adds the ACPI code. It is similar to the one in EDK2 but doesn't assume that SMIs are necessary to use. It uses a similar datastructure for the shared memory as EDK2 does so that EDK2 and SeaBIOS could both make use of it. I extended the shared memory data structure with an array of 256 bytes, one for each code that could be implemented. The array contains flags describing the individual codes. This decouples the ACPI implementati= on from the firmware implementation. The underlying TCG specification is accessible from the following page. https://trustedcomputinggroup.org/tcg-physical-presence-interface-specifica= tion/ This patch implements version 1.30. Signed-off-by: Stefan Berger --- v6: - more code documentation (Marc-Andr=C3=A9) - use some explicit named variables to ease reading (Marc-Andr=C3=A9) - use fixed size fields/memory regions, remove PPI struct (Marc-Andr=C3=A9) - only add PPI ACPI methods if PPI is enabled (Marc-Andr=C3=A9) - document the qemu/firmware ACPI memory region (Stefan) v5 (Marc-Andr=C3=A9): - /struct tpm_ppi/struct TPMPPIData v4 (Marc-Andr=C3=A9): - replace 'DerefOf (FUNC [N])' with a function, to fix Windows ACPI handling. - replace 'return Package (..) {} ' with scoped variables, to fix Windows ACPI handling. v3: - add support for PPI to CRB - split up OperationRegion TPPI into two parts, one containing the registers (TPP1) and the other one the flags (TPP2); switched the order of the flags versus registers in the code - adapted ACPI code to small changes to the array of flags where previous flag 0 was removed and now shifting right wasn't always necessary anymore v2: - get rid of FAIL variable; function 5 was using it and always returns 0; the value is related to the ACPI function call not a possible failure of the TPM function call. - extend shared memory data structure with per-opcode entries holding flags and use those flags to determine what to return to caller - implement interface version 1.3 --- include/hw/acpi/tpm.h | 8 + hw/i386/acpi-build.c | 423 +++++++++++++++++++++++++++++++++++++++++- docs/specs/tpm.txt | 79 ++++++++ 3 files changed, 509 insertions(+), 1 deletion(-) diff --git a/include/hw/acpi/tpm.h b/include/hw/acpi/tpm.h index f79d68a77a..e0bd07862e 100644 --- a/include/hw/acpi/tpm.h +++ b/include/hw/acpi/tpm.h @@ -196,4 +196,12 @@ REG32(CRB_DATA_BUFFER, 0x80) #define TPM_PPI_VERSION_NONE 0 #define TPM_PPI_VERSION_1_30 1 =20 +/* whether function is blocked by BIOS settings; bits 0, 1, 2 */ +#define TPM_PPI_FUNC_NOT_IMPLEMENTED (0 << 0) +#define TPM_PPI_FUNC_BIOS_ONLY (1 << 0) +#define TPM_PPI_FUNC_BLOCKED (2 << 0) +#define TPM_PPI_FUNC_ALLOWED_USR_REQ (3 << 0) +#define TPM_PPI_FUNC_ALLOWED_USR_NOT_REQ (4 << 0) +#define TPM_PPI_FUNC_MASK (7 << 0) + #endif /* HW_ACPI_TPM_H */ diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c index d9320845ed..d815af4eef 100644 --- a/hw/i386/acpi-build.c +++ b/hw/i386/acpi-build.c @@ -43,6 +43,7 @@ #include "hw/acpi/memory_hotplug.h" #include "sysemu/tpm.h" #include "hw/acpi/tpm.h" +#include "hw/tpm/tpm_ppi.h" #include "hw/acpi/vmgenid.h" #include "sysemu/tpm_backend.h" #include "hw/timer/mc146818rtc_regs.h" @@ -1789,6 +1790,421 @@ static Aml *build_q35_osc_method(void) return method; } =20 +static void +build_tpm_ppi(Aml *dev) +{ + Aml *method, *name, *field, *ifctx, *ifctx2, *ifctx3, *pak; + int i; + + if (!object_property_get_bool(OBJECT(tpm_find()), "ppi", &error_abort)= ) { + return; + } + /* + * TPP1 is for the flags that indicate which PPI operations + * are supported by the firmware. The firmware is expected to + * write these flags. + */ + aml_append(dev, + aml_operation_region("TPP1", AML_SYSTEM_MEMORY, + aml_int(TPM_PPI_ADDR_BASE), 0x100)); + field =3D aml_field("TPP1", AML_ANY_ACC, AML_NOLOCK, AML_PRESERVE); + for (i =3D 0; i < 0x100; i++) { + char *tmp =3D g_strdup_printf("FN%02X", i); + aml_append(field, aml_named_field(tmp, 8)); + g_free(tmp); + } + aml_append(dev, field); + + /* + * TPP2 is for the registers that ACPI code used to pass + * the PPI code and parameter (PPRQ, PPRM) to the firmware. + */ + aml_append(dev, + aml_operation_region("TPP2", AML_SYSTEM_MEMORY, + aml_int(TPM_PPI_ADDR_BASE + 0x100), + 0x5A)); + field =3D aml_field("TPP2", AML_ANY_ACC, AML_NOLOCK, AML_PRESERVE); + aml_append(field, aml_named_field("PPIN", 8)); + aml_append(field, aml_named_field("PPIP", 32)); + aml_append(field, aml_named_field("PPRP", 32)); + aml_append(field, aml_named_field("PPRQ", 32)); + aml_append(field, aml_named_field("PPRM", 32)); + aml_append(field, aml_named_field("LPPR", 32)); + aml_append(dev, field); + + /* + * A function to return the value of DerefOf (FUNC [N]), by using + * accessing the fields individually instead. This is a workaround + * for what looks like a Windows ACPI bug in all versions so far + * (fwiw, DerefOf (FUNC [N]) works on Linux). + */ + method =3D aml_method("TPFN", 1, AML_SERIALIZED); + { + for (i =3D 0; i < 0x100; i++) { + ifctx =3D aml_if(aml_equal(aml_int(i), aml_arg(0))); + { + aml_append(ifctx, aml_return(aml_name("FN%02X", i))); + } + aml_append(method, ifctx); + } + aml_append(method, aml_return(aml_int(0))); + } + aml_append(dev, method); + + pak =3D aml_package(2); + aml_append(pak, aml_int(0)); + aml_append(pak, aml_int(0)); + name =3D aml_name_decl("TPM2", pak); + aml_append(dev, name); + + pak =3D aml_package(3); + aml_append(pak, aml_int(0)); + aml_append(pak, aml_int(0)); + aml_append(pak, aml_int(0)); + name =3D aml_name_decl("TPM3", pak); + aml_append(dev, name); + + method =3D aml_method("_DSM", 4, AML_SERIALIZED); + { + uint8_t zerobyte[1] =3D { 0 }; + Aml *func_idx, *rev, *op, *op_arg, *op_flags; + + ifctx =3D aml_if( + aml_equal(aml_arg(0), + aml_touuid("3DDDFAA6-361B-4EB4-A424-8D10089D1653"))); + { + func_idx =3D aml_local(0); + aml_append(ifctx, + aml_store(aml_to_integer(aml_arg(2)), func_idx)); + + /* standard DSM query function */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(0))); + { + uint8_t byte_list[2] =3D { 0xff, 0x01 }; + aml_append(ifctx2, aml_return(aml_buffer(2, byte_list))); + } + aml_append(ifctx, ifctx2); + + /* + * 8.1.1 Get Physical Presence Interface Version + * + * Arg 2 (Integer): Function Index =3D 1 + * Arg 3 (Package): Arguments =3D Empty Package + * Returns: Type: String + */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(1))); + { + aml_append(ifctx2, aml_return(aml_string("1.3"))); + } + aml_append(ifctx, ifctx2); + + /* + * 8.1.2 Submit TPM Operation Request to Pre-OS Environment + * + * Arg 2 (Integer): Function Index =3D 2 + * Arg 3 (Package): Arguments =3D Package: Type: Integer + * Operation Value of the Request + * Returns: Type: Integer + * 0: Success + * 1: Operation Value of the Request Not Supported + * 2: General Failure + */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(2))); + { + /* get opcode */ + op =3D aml_derefof(aml_index(aml_arg(3), aml_int(0))); + aml_append(ifctx2, aml_store(op, aml_local(0))); + + /* get opcode flags */ + op =3D aml_local(0); + aml_append(ifctx2, + aml_store(aml_call1("TPFN", op), aml_local(1))); + + op_flags =3D aml_local(1); + /* if func[opcode] & TPM_PPI_FUNC_NOT_IMPLEMENTED */ + ifctx3 =3D aml_if( + aml_equal( + aml_and(op_flags, aml_int(TPM_PPI_FUNC_MASK), NULL= ), + aml_int(TPM_PPI_FUNC_NOT_IMPLEMENTED))); + { + /* 1: not implemented */ + aml_append(ifctx3, aml_return(aml_int(1))); + } + aml_append(ifctx2, ifctx3); + + op =3D aml_local(0); + aml_append(ifctx2, aml_store(op, aml_name("PPRQ"))); + aml_append(ifctx2, aml_store(aml_int(0), aml_name("PPRM"))= ); + /* 0: success */ + aml_append(ifctx2, aml_return(aml_int(0))); + } + aml_append(ifctx, ifctx2); + + /* + * 8.1.3 Get Pending TPM Operation Requested By the OS + * + * Arg 2 (Integer): Function Index =3D 3 + * Arg 3 (Package): Arguments =3D Empty Package + * Returns: Type: Package of Integers + * Integer 1: Function Return code + * 0: Success + * 1: General Failure + * Integer 2: Pending operation requested by the OS + * 0: None + * >0: Operation Value of the Pending Reque= st + * Integer 3: Optional argument to pending operation + * requested by the OS + * 0: None + * >0: Argument Value of the Pending Request + */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(3))); + { + /* revision to integer */ + aml_append(ifctx2, + aml_store( + aml_to_integer(aml_arg(1)), + aml_local(1))); + /* + * Revision ID of 1, no integer parameter beyond + * parameter two are expected + */ + rev =3D aml_local(1); + ifctx3 =3D aml_if(aml_equal(rev, aml_int(1))); + { + /* TPM2[1] =3D PPRQ */ + aml_append(ifctx3, + aml_store( + aml_name("PPRQ"), + aml_index(aml_name("TPM2"), aml_int(1))= )); + aml_append(ifctx3, aml_return(aml_name("TPM2"))); + } + aml_append(ifctx2, ifctx3); + + /* + * A return value of {0, 23, 1} indicates that + * operation 23 with argument 1 is pending. + */ + rev =3D aml_local(1); + ifctx3 =3D aml_if(aml_equal(rev, aml_int(2))); + { + /* TPM3[1] =3D PPRQ */ + aml_append(ifctx3, + aml_store( + aml_name("PPRQ"), + aml_index(aml_name("TPM3"), aml_int(1))= )); + /* TPM3[2] =3D PPRM */ + aml_append(ifctx3, + aml_store( + aml_name("PPRM"), + aml_index(aml_name("TPM3"), aml_int(2))= )); + aml_append(ifctx3, aml_return(aml_name("TPM3"))); + } + aml_append(ifctx2, ifctx3); + } + aml_append(ifctx, ifctx2); + + /* + * 8.1.4 Get Platform-Specific Action to Transition to + * Pre-OS Environment + * + * Arg 2 (Integer): Function Index =3D 4 + * Arg 3 (Package): Arguments =3D Empty Package + * Returns: Type: Integer + * 0: None + * 1: Shutdown + * 2: Reboot + * 3: OS Vendor-specific + */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(4))); + { + /* reboot */ + aml_append(ifctx2, aml_return(aml_int(2))); + } + aml_append(ifctx, ifctx2); + + /* + * 8.1.5 Return TPM Operation Response to OS Environment + * + * Arg 2 (Integer): Function Index =3D 5 + * Arg 3 (Package): Arguments =3D Empty Package + * Returns: Type: Package of Integer + * Integer 1: Function Return code + * 0: Success + * 1: General Failure + * Integer 2: Most recent operation request + * 0: None + * >0: Operation Value of the most recent r= equest + * Integer 3: Response to the most recent operation r= equest + * 0: Success + * 0x00000001..0x00000FFF: Corresponding T= PM + * error code + * 0xFFFFFFF0: User Abort or timeout of di= alog + * 0xFFFFFFF1: firmware Failure + */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(5))); + { + /* TPM3[1] =3D LPPR */ + aml_append(ifctx2, + aml_store( + aml_name("LPPR"), + aml_index(aml_name("TPM3"), aml_int(1)))); + /* TPM3[2] =3D PPRP */ + aml_append(ifctx2, + aml_store( + aml_name("PPRP"), + aml_index(aml_name("TPM3"), aml_int(2)))); + aml_append(ifctx2, aml_return(aml_name("TPM3"))); + } + aml_append(ifctx, ifctx2); + + /* + * 8.1.6 Submit preferred user language + * + * Arg 2 (Integer): Function Index =3D 6 + * Arg 3 (Package): Arguments =3D String Package + * Preferred language code + * Returns: Type: Integer + * Function Return Code + * 3: Not implemented + */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(6))); + { + /* 3 =3D not implemented */ + aml_append(ifctx2, aml_return(aml_int(3))); + } + aml_append(ifctx, ifctx2); + + /* + * 8.1.7 Submit TPM Operation Request to Pre-OS Environment 2 + * + * Arg 2 (Integer): Function Index =3D 7 + * Arg 3 (Package): Arguments =3D Package: Type: Integer + * Integer 1: Operation Value of the Request + * Integer 2: Argument for Operation (optiona= l) + * Returns: Type: Integer + * 0: Success + * 1: Not Implemented + * 2: General Failure + * 3: Operation blocked by current firmware settings + */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(7))); + { + /* get opcode */ + op =3D aml_derefof(aml_index(aml_arg(3), aml_int(0))); + aml_append(ifctx2, aml_store(op, aml_local(0))); + + /* get opcode flags */ + op =3D aml_local(0); + aml_append(ifctx2, aml_store(aml_call1("TPFN", op), + aml_local(1))); + /* if func[opcode] & TPM_PPI_FUNC_NOT_IMPLEMENTED */ + op_flags =3D aml_local(1); + ifctx3 =3D aml_if( + aml_equal( + aml_and(op_flags, aml_int(TPM_PPI_FUNC_MASK), NULL= ), + aml_int(TPM_PPI_FUNC_NOT_IMPLEMENTED))); + { + /* 1: not implemented */ + aml_append(ifctx3, aml_return(aml_int(1))); + } + aml_append(ifctx2, ifctx3); + + /* if func[opcode] & TPM_PPI_FUNC_BLOCKED */ + op_flags =3D aml_local(1); + ifctx3 =3D aml_if( + aml_equal( + aml_and(op_flags, aml_int(TPM_PPI_FUNC_MASK), NULL= ), + aml_int(TPM_PPI_FUNC_BLOCKED))); + { + /* 3: blocked by firmware */ + aml_append(ifctx3, aml_return(aml_int(3))); + } + aml_append(ifctx2, ifctx3); + + /* revision to integer */ + aml_append(ifctx2, + aml_store( + aml_to_integer(aml_arg(1)), + aml_local(1))); + + rev =3D aml_local(1); + ifctx3 =3D aml_if(aml_equal(rev, aml_int(1))); + { + /* revision 1 */ + /* PPRQ =3D op */ + op =3D aml_local(0); + aml_append(ifctx3, aml_store(op, aml_name("PPRQ"))); + /* no argument, PPRM =3D 0 */ + aml_append(ifctx3, aml_store(aml_int(0), + aml_name("PPRM"))); + } + aml_append(ifctx2, ifctx3); + + rev =3D aml_local(1); + ifctx3 =3D aml_if(aml_equal(rev, aml_int(2))); + { + /* revision 2 */ + /* PPRQ =3D op */ + op =3D aml_local(0); + op_arg =3D aml_derefof(aml_index(aml_arg(3), aml_int(1= ))); + aml_append(ifctx3, aml_store(op, aml_name("PPRQ"))); + /* PPRM =3D arg3[1] */ + aml_append(ifctx3, aml_store(op_arg, aml_name("PPRM"))= ); + } + aml_append(ifctx2, ifctx3); + /* 0: success */ + aml_append(ifctx2, aml_return(aml_int(0))); + } + aml_append(ifctx, ifctx2); + + /* + * 8.1.8 Get User Confirmation Status for Operation + * + * Arg 2 (Integer): Function Index =3D 8 + * Arg 3 (Package): Arguments =3D Package: Type: Integer + * Operation Value that may need user confirm= ation + * Returns: Type: Integer + * 0: Not implemented + * 1: Firmware only + * 2: Blocked for OS by firmware configuration + * 3: Allowed and physically present user required + * 4: Allowed and physically present user not required + */ + func_idx =3D aml_local(0); + ifctx2 =3D aml_if(aml_equal(func_idx, aml_int(8))); + { + /* get opcode */ + op =3D aml_derefof(aml_index(aml_arg(3), aml_int(0))); + aml_append(ifctx2, aml_store(op, aml_local(0))); + + /* get opcode flags */ + op =3D aml_local(0); + aml_append(ifctx2, aml_store(aml_call1("TPFN", op), + aml_local(1))); + op_flags =3D aml_local(1); + /* return confirmation status code */ + aml_append(ifctx2, + aml_return( + aml_and(op_flags, + aml_int(TPM_PPI_FUNC_MASK), NULL))); + } + aml_append(ifctx, ifctx2); + + aml_append(ifctx, aml_return(aml_buffer(1, zerobyte))); + } + aml_append(method, ifctx); + } + aml_append(dev, method); +} + static void build_dsdt(GArray *table_data, BIOSLinker *linker, AcpiPmInfo *pm, AcpiMiscInfo *misc, @@ -2153,6 +2569,9 @@ build_dsdt(GArray *table_data, BIOSLinker *linker, */ /* aml_append(crs, aml_irq_no_flags(TPM_TIS_IRQ)); */ aml_append(dev, aml_name_decl("_CRS", crs)); + + build_tpm_ppi(dev); + aml_append(scope, dev); } =20 @@ -2172,6 +2591,8 @@ build_dsdt(GArray *table_data, BIOSLinker *linker, aml_append(method, aml_return(aml_int(0x0f))); aml_append(dev, method); =20 + build_tpm_ppi(dev); + aml_append(sb_scope, dev); } =20 @@ -2920,7 +3341,7 @@ void acpi_setup(void) tpm_config =3D (FWCfgTPMConfig) { .tpmppi_address =3D cpu_to_le32(TPM_PPI_ADDR_BASE), .tpm_version =3D cpu_to_le32(tpm_get_version(tpm_find())), - .tpmppi_version =3D cpu_to_le32(TPM_PPI_VERSION_NONE) + .tpmppi_version =3D cpu_to_le32(TPM_PPI_VERSION_1_30) }; fw_cfg_add_file(pcms->fw_cfg, "etc/tpm/config", &tpm_config, sizeof tpm_config); diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt index 2ddb768084..c27762c723 100644 --- a/docs/specs/tpm.txt +++ b/docs/specs/tpm.txt @@ -62,6 +62,85 @@ URL: =20 https://trustedcomputinggroup.org/tcg-acpi-specification/ =20 +=3D=3D ACPI PPI Interface =3D=3D + +QEMU supports the Physical Presence Interface (PPI) for TPM 1.2 and TPM 2.= This +interface requires ACPI and firmware support. The specification can be fou= nd at +the following URL: + +https://trustedcomputinggroup.org/resource/tcg-physical-presence-interface= -specification/ + +PPI enables a system administrator (root) to request a modification to the +TPM upon reboot. The PPI specification defines the operation requests and = the +actions the firmware has to take. The system administrator passes the oper= ation +request number to the firmware through an ACPI interface which writes this +number to a memory location that the firmware knows. Upon reboot, the firm= ware +finds the number and sends commands to the the TPM. The firmware writes th= e TPM +result code and the operation request number to a memory location that ACP= I can +read from and pass the result on to the administrator. + +The PPI specification defines a set of mandatory and optional operations f= or +the firmware to implement. The ACPI interface also allows an administrator= to +list the supported operations. In QEMU the ACPI code is generated by QEMU,= yet +the firmware needs to implement support on a per-operations basis, and +different firmwares may support a different subset. Therefore, QEMU introd= uces +the virtual memory device for PPI where the firmware can indicate which +operations it supports and ACPI can enable the ones that are supported and +disable all others. This interface lies in main memory and has the followi= ng +layout: + + +----------+--------+--------+-------------------------------------------+ + | Field | Length | Offset | Description | + +----------+--------+--------+-------------------------------------------+ + | func | 0x100 | 0x000 | Firmware sets values for each supported | + | | | | operation. See defined values below. | + +----------+--------+--------+-------------------------------------------+ + | ppin | 0x1 | 0x100 | SMI interrupt to use. Set by firmware. | + | | | | Not supported. | + +----------+--------+--------+-------------------------------------------+ + | ppip | 0x4 | 0x101 | ACPI function index to pass to SMM code. | + | | | | Set by ACPI. Not supported. | + +----------+--------+--------+-------------------------------------------+ + | pprp | 0x4 | 0x105 | Result of last executed operation. Set by | + | | | | firmware. See function index 5 for values.| + +----------+--------+--------+-------------------------------------------+ + | pprq | 0x4 | 0x109 | Operation request number to execute. See | + | | | | 'Physical Presence Interface Operation | + | | | | Summary' tables in specs. Set by ACPI. | + +----------+--------+--------+-------------------------------------------+ + | pprm | 0x4 | 0x10d | Operation request optional parameter. | + | | | | Values depend on operation. Set by ACPI. | + +----------+--------+--------+-------------------------------------------+ + | lppr | 0x4 | 0x111 | Last executed operation request number. | + | | | | Copied from pprq field by firmware. | + +----------+--------+--------+-------------------------------------------+ + | fret | 0x4 | 0x115 | Result code from SMM function. | + | | | | Not supported. | + +----------+--------+--------+-------------------------------------------+ + | res1 | 0x40 | 0x119 | Reserved for future use | + +----------+--------+--------+-------------------------------------------+ + | next_step| 0x1 | 0x159 | Operation to execute after reboot by | + | | | | firmware. Used by firmware. | + +----------+--------+--------+-------------------------------------------+ + + The following values are supported for the 'func' field. They correspond + to the values used by ACPI function index 8. + + +----------+-------------------------------------------------------------+ + | value | Description | + +----------+-------------------------------------------------------------+ + | 0 | Operation is not implemented. | + +----------+-------------------------------------------------------------+ + | 1 | Operation is only accessible through firmware. | + +----------+-------------------------------------------------------------+ + | 2 | Operation is blocked for OS by firmware configuration. | + +----------+-------------------------------------------------------------+ + | 3 | Operation is allowed and physically present user required. | + +----------+-------------------------------------------------------------+ + | 4 | Operation is allowed and physically present user is not | + | | required. | + +----------+-------------------------------------------------------------+ + =20 QEMU files related to TPM ACPI tables: - hw/i386/acpi-build.c --=20 2.18.0.rc1