From nobody Tue Feb 10 00:59:35 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1547505401372390.9736817193518; Mon, 14 Jan 2019 14:36:41 -0800 (PST) Received: from localhost ([127.0.0.1]:53375 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gjAqW-00037W-EE for importer@patchew.org; Mon, 14 Jan 2019 17:36:40 -0500 Received: from eggs.gnu.org ([209.51.188.92]:58956) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gjAoq-00020R-FM for qemu-devel@nongnu.org; Mon, 14 Jan 2019 17:34:58 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gjAop-0006Cj-I9 for qemu-devel@nongnu.org; Mon, 14 Jan 2019 17:34:56 -0500 Received: from mx1.redhat.com ([209.132.183.28]:54150) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gjAop-0006C4-9g for qemu-devel@nongnu.org; Mon, 14 Jan 2019 17:34:55 -0500 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 62FA813A9A; Mon, 14 Jan 2019 22:29:32 +0000 (UTC) Received: from localhost (ovpn-112-47.ams2.redhat.com [10.36.112.47]) by smtp.corp.redhat.com (Postfix) with ESMTP id B24E46E3EB; Mon, 14 Jan 2019 22:29:26 +0000 (UTC) From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= To: qemu-devel@nongnu.org Date: Tue, 15 Jan 2019 02:27:54 +0400 Message-Id: <20190114222754.21701-7-marcandre.lureau@redhat.com> In-Reply-To: <20190114222754.21701-1-marcandre.lureau@redhat.com> References: <20190114222754.21701-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Mon, 14 Jan 2019 22:29:32 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v17 6/6] tpm: clear RAM when "memory overwrite" requested X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , stefanb@linux.vnet.ibm.com, "Michael S. Tsirkin" , f4bug@amsat.org, Igor Mammedov , Paolo Bonzini , Richard Henderson , Stefan Berger Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" Note: the "Platform Reset Attack Mitigation" specification isn't explicit about NVDIMM, since they could have different usages. It uses the term "system memory" generally (and also "volatile memory RAM" in its introduction). For initial support, I propose to consider non-volatile memory as not being subject to the memory clear. There is an on-going discussion in the TCG "pcclientwg" working group for future revisions. CPU cache clearing is done unconditionally in edk2 since commit d20ae95a13e851 (edk2-stable201811). Signed-off-by: Marc-Andr=C3=A9 Lureau Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Michael S. Tsirkin Tested-by: Stefan Berger --- hw/tpm/tpm_ppi.h | 10 ++++++++++ hw/tpm/tpm_crb.c | 3 +++ hw/tpm/tpm_ppi.c | 22 ++++++++++++++++++++++ hw/tpm/tpm_tis.c | 3 +++ hw/tpm/trace-events | 3 +++ 5 files changed, 41 insertions(+) diff --git a/hw/tpm/tpm_ppi.h b/hw/tpm/tpm_ppi.h index c5e555fe2c7..d33ef27de6d 100644 --- a/hw/tpm/tpm_ppi.h +++ b/hw/tpm/tpm_ppi.h @@ -33,4 +33,14 @@ typedef struct TPMPPI { void tpm_ppi_init(TPMPPI *tpmppi, struct MemoryRegion *m, hwaddr addr, Object *obj); =20 +/** + * tpm_ppi_reset: + * @tpmppi: a TPMPPI + * + * Function to call on machine reset. It will check if the "Memory + * overwrite" variable is set, and perform a memory clear on volatile + * memory if requested. + **/ +void tpm_ppi_reset(TPMPPI *tpmppi); + #endif /* TPM_TPM_PPI_H */ diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index 012ec686d4b..3087acc4ab7 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -233,6 +233,9 @@ static void tpm_crb_reset(void *dev) { CRBState *s =3D CRB(dev); =20 + if (s->ppi_enabled) { + tpm_ppi_reset(&s->ppi); + } tpm_backend_reset(s->tpmbe); =20 memset(s->regs, 0, sizeof(s->regs)); diff --git a/hw/tpm/tpm_ppi.c b/hw/tpm/tpm_ppi.c index cf17779c20f..cd8205f2120 100644 --- a/hw/tpm/tpm_ppi.c +++ b/hw/tpm/tpm_ppi.c @@ -16,8 +16,30 @@ #include "qapi/error.h" #include "cpu.h" #include "sysemu/memory_mapping.h" +#include "sysemu/reset.h" #include "migration/vmstate.h" #include "tpm_ppi.h" +#include "trace.h" + +void tpm_ppi_reset(TPMPPI *tpmppi) +{ + if (tpmppi->buf[0x15a /* movv, docs/specs/tpm.txt */] & 0x1) { + GuestPhysBlockList guest_phys_blocks; + GuestPhysBlock *block; + + guest_phys_blocks_init(&guest_phys_blocks); + guest_phys_blocks_append(&guest_phys_blocks); + QTAILQ_FOREACH(block, &guest_phys_blocks.head, next) { + trace_tpm_ppi_memset(block->host_addr, + block->target_end - block->target_start); + memset(block->host_addr, 0, + block->target_end - block->target_start); + memory_region_set_dirty(block->mr, 0, + block->target_end - block->target_star= t); + } + guest_phys_blocks_free(&guest_phys_blocks); + } +} =20 void tpm_ppi_init(TPMPPI *tpmppi, struct MemoryRegion *m, hwaddr addr, Object *obj) diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c index 02d9d5c911d..fd6bb9b59a9 100644 --- a/hw/tpm/tpm_tis.c +++ b/hw/tpm/tpm_tis.c @@ -872,6 +872,9 @@ static void tpm_tis_reset(DeviceState *dev) s->be_buffer_size =3D MIN(tpm_backend_get_buffer_size(s->be_driver), TPM_TIS_BUFFER_MAX); =20 + if (s->ppi_enabled) { + tpm_ppi_reset(&s->ppi); + } tpm_backend_reset(s->be_driver); =20 s->active_locty =3D TPM_TIS_NO_LOCALITY; diff --git a/hw/tpm/trace-events b/hw/tpm/trace-events index 25bee0cecf9..920d32ad551 100644 --- a/hw/tpm/trace-events +++ b/hw/tpm/trace-events @@ -51,3 +51,6 @@ tpm_tis_mmio_write_init_abort(void) "Initiating abort" tpm_tis_mmio_write_lowering_irq(void) "Lowering IRQ" tpm_tis_mmio_write_data2send(uint32_t value, unsigned size) "Data to send = to TPM: 0x%08x (size=3D%d)" tpm_tis_pre_save(uint8_t locty, uint32_t rw_offset) "locty: %d, rw_offset = =3D %u" + +# hw/tpm/tpm_ppi.c +tpm_ppi_memset(uint8_t *ptr, size_t size) "memset: %p %zu" --=20 2.20.1.98.gecbdaf0899