From nobody Fri Nov 7 01:05:39 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1544653947870669.56961144025; Wed, 12 Dec 2018 14:32:27 -0800 (PST) Received: from localhost ([::1]:49028 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gXD3K-0008K4-O8 for importer@patchew.org; Wed, 12 Dec 2018 17:32:26 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48429) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gXCzA-00051j-4G for qemu-devel@nongnu.org; Wed, 12 Dec 2018 17:28:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gXCz4-0004ZE-NC for qemu-devel@nongnu.org; Wed, 12 Dec 2018 17:28:07 -0500 Received: from mx1.redhat.com ([209.132.183.28]:37956) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gXCz4-0004Vs-AL for qemu-devel@nongnu.org; Wed, 12 Dec 2018 17:28:02 -0500 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D17523001A52; Wed, 12 Dec 2018 22:28:00 +0000 (UTC) Received: from localhost (ovpn-112-51.ams2.redhat.com [10.36.112.51]) by smtp.corp.redhat.com (Postfix) with ESMTP id F12522617B; Wed, 12 Dec 2018 22:27:40 +0000 (UTC) From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= To: qemu-devel@nongnu.org Date: Thu, 13 Dec 2018 02:26:47 +0400 Message-Id: <20181212222648.595-6-marcandre.lureau@redhat.com> In-Reply-To: <20181212222648.595-1-marcandre.lureau@redhat.com> References: <20181212222648.595-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.44]); Wed, 12 Dec 2018 22:28:01 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v13 5/6] acpi: add ACPI memory clear interface X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , "Michael S. Tsirkin" , stefanb@linux.vnet.ibm.com, f4bug@amsat.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Igor Mammedov , Paolo Bonzini , Richard Henderson , Stefan Berger Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" The interface is described in the "TCG Platform Reset Attack Mitigation Specification", chapter 6 "ACPI _DSM Function". According to Laszlo, it's not so easy to implement in OVMF, he suggested to do it in qemu instead. See specification documentation for more details, and next commit for memory clear on reset handling. Signed-off-by: Marc-Andr=C3=A9 Lureau --- include/hw/acpi/tpm.h | 2 ++ hw/acpi/tpm.c | 47 +++++++++++++++++++++++++++++++++++++++++++ docs/specs/tpm.txt | 2 ++ 3 files changed, 51 insertions(+) diff --git a/include/hw/acpi/tpm.h b/include/hw/acpi/tpm.h index 1a2a57a21f..7245eac4f9 100644 --- a/include/hw/acpi/tpm.h +++ b/include/hw/acpi/tpm.h @@ -207,6 +207,8 @@ REG32(CRB_DATA_BUFFER, 0x80) #define TPM_PPI_FUNC_ALLOWED_USR_NOT_REQ (4 << 0) #define TPM_PPI_FUNC_MASK (7 << 0) =20 +#define TPM_PPI_MOVV_OFFSET 0x15a + void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev); =20 #endif /* HW_ACPI_TPM_H */ diff --git a/hw/acpi/tpm.c b/hw/acpi/tpm.c index fee9490306..e3f92db570 100644 --- a/hw/acpi/tpm.c +++ b/hw/acpi/tpm.c @@ -53,6 +53,15 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev) pprq =3D aml_name("PPRQ"); pprm =3D aml_name("PPRM"); =20 + aml_append(dev, + aml_operation_region("TPP3", AML_SYSTEM_MEMORY, + aml_int(TPM_PPI_ADDR_BASE + + TPM_PPI_MOVV_OFFSET), + 0x1)); + field =3D aml_field("TPP3", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE); + aml_append(field, aml_named_field("MOVV", 8)); + aml_append(dev, field); + /* * DerefOf in Windows is broken with SYSTEM_MEMORY. Use a dynamic * operation region inside of a method for getting FUNC[op]. @@ -395,6 +404,44 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev) aml_append(ifctx, aml_return(aml_buffer(1, zerobyte))); } aml_append(method, ifctx); + + ifctx =3D aml_if( + aml_equal(uuid, + aml_touuid("376054ED-CC13-4675-901C-4756D7F2D45D"))); + { + /* standard DSM query function */ + ifctx2 =3D aml_if(aml_equal(function, zero)); + { + uint8_t byte_list[1] =3D { 0x03 }; + aml_append(ifctx2, aml_return(aml_buffer(1, byte_list))); + } + aml_append(ifctx, ifctx2); + + /* + * TCG Platform Reset Attack Mitigation Specification 1.0 Ch.6 + * + * Arg 2 (Integer): Function Index =3D 1 + * Arg 3 (Package): Arguments =3D Package: Type: Integer + * Operation Value of the Request + * Returns: Type: Integer + * 0: Success + * 1: General Failure + */ + ifctx2 =3D aml_if(aml_equal(function, one)); + { + aml_append(ifctx2, + aml_store(aml_derefof(aml_index(arguments, zero= )), + op)); + { + aml_append(ifctx2, aml_store(op, aml_name("MOVV"))); + + /* 0: success */ + aml_append(ifctx2, aml_return(zero)); + } + } + aml_append(ifctx, ifctx2); + } + aml_append(method, ifctx); } aml_append(dev, method); } diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt index 424d1511fc..5d8c26b1ad 100644 --- a/docs/specs/tpm.txt +++ b/docs/specs/tpm.txt @@ -135,6 +135,8 @@ layout: +----------+--------+--------+-------------------------------------------+ | next_step| 0x1 | 0x159 | Operation to execute after reboot by | | | | | firmware. Used by firmware. | + +----------+--------+--------+-------------------------------------------+ + | movv | 0x1 | 0x15a | Memory overwrite variable | +----------+--------+--------+-------------------------------------------+ =20 The following values are supported for the 'func' field. They correspond --=20 2.20.0