On 02/23/2018 10:55 AM, Laszlo Ersek wrote:
On 02/23/18 14:23, marcandre.lur...@redhat.com wrote:
From: Marc-André Lureau <marcandre.lur...@redhat.com>
Hi,
The following series adds basic TPM2 support for OVMF-on-QEMU (I
haven't tested TPM1, for lack of interest). It links with the modules
to initializes the device in PEI phase, and do measurements (both PEI
and DXE). The Tcg2Dxe module provides the Tcg2 protocol which allows
the guest to access the measurement log and other facilities.
DxeTpm2MeasureBootLib seems to do its job at measuring images that are
not measured in PEI phase (such as PCI PXE rom)
Tcg2ConfigDxe is mostly interesting for debugging for now.
A major lack is the support for Physical Present Interface (PPI, more
below).
Linux guests seem to work fine. But windows guest generally complains
about the lack of PPI interface (most HLK tests require it, tpm.msc
admin interactions too). I haven't done "real" use-cases tests, as I
lack experience with TPM usage. Any help appreciated to test the TPM.
Tcg2ConfigPei requires variable access, therefore
<https://bugzilla.tianocore.org/show_bug.cgi?id=386> must be solved
first. I used "[edk2] [PATCH v2 0/8] OvmfPkg: add the Variable PEIM,
defragment the UEFI memmap" as a base for this series.
I build edk2 with:
$ build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -DMEM_VARSTORE_EMU_ENABLE=FALSE
I test with qemu & swtpm/libtpms (tpm2 branches, swtpm_setup.sh --tpm2
--tpm-state tpmstatedir)
$ swtpm socket --tpmstate tpmstatedir --ctrl type=unixio,path=tpmsock --tpm2 &
$ qemu .. -chardev socket,id=chrtpm,path=tpmsock -tpmdev
emulator,id=tpm0,chardev=chrtpm -device tpm-crb,tpmdev=tpm0
Thanks for this work -- extra thanks for the instructions regarding the
software TPM backend.
Please use the tpm2-preview.v2 branch of swtpm and the
tpm2-preview.rev146.v2 branch of libtpms. I had to change the way the
state is serialized, so unfortunately you will also have to remove the
tpm2-00.permall files.
Stefan
