On 06/26/18 14:34, Igor Mammedov wrote:
On Tue, 26 Jun 2018 11:22:26 +0200
Marc-André Lureau <address@hidden> wrote:
On Thu, Jun 21, 2018 at 4:33 PM, Igor Mammedov <address@hidden> wrote:
On Thu, 21 Jun 2018 15:24:44 +0200
Marc-André Lureau <address@hidden> wrote:
Hi
On Thu, Jun 21, 2018 at 3:02 PM, Igor Mammedov <address@hidden> wrote:
On Tue, 15 May 2018 14:14:33 +0200
Marc-André Lureau <address@hidden> wrote:
This allows to pass the last failing test from the Windows HLK TPM 2.0
TCG PPI 1.3 tests.
The interface is described in the "TCG Platform Reset Attack
Mitigation Specification", chapter 6 "ACPI _DSM Function". Whether or
not we should have a real implementation remains an open question to me.
might it cause security issues?
Good question. If the guest assumes success of this operation perhaps.
I'll check the spec.
What are implications of faking it and how hard it's to implement thing
per spec?
Laszlo answerd that in "[Qemu-devel] investigating TPM for
OVMF-on-QEMU" 2f2b) TCG Memory Clear Interface
I get that it's optional, but we probably shouldn't advertise/fake
feature if it's not supported.
As said in the commit message, the objective was to pass the Windows
HLK test. If we don't want to advertize a fake interface, I am fine
droping this patch. We'll have to revisit with Laszlo the work needed
in the firmware to support it.
I think it would be safer to drop this patch.
This is BTW a feature that's very difficult for OVMF to implement, but
(I think) near trivial for QEMU to implement. The feature is about
clearing all of the guest RAM to zero at reboot.
For the firmware, it's difficult to solve, because in the 32-bit PEI
phase, we don't map DRAM beyond 4GB, so we can't re-set memory to zero
via normal addressing. (For physical platforms, this is different,
because their PEI phases have PEI modules that initialize the memory
controller(s), so they have platform-specific means to clear RAM.) For
QEMU, on the other hand, the feature "shouldn't be hard (TM)", just
implement a reset handler that clears all RAMBlocks on the host side (or
some such :) ).