Re: [Qemu-devel] [PATCH 0/7] RFC: ovmf: preliminary TPM2 support

[Stefan Berger <stefanb@linux.vnet.ibm.com>]

On 02/23/2018 10:55 AM, Laszlo Ersek wrote:
> On 02/23/18 14:23, marcandre.lureau@redhat.com wrote:
>> From: Marc-André Lureau <marcandre.lureau@redhat.com>
>>
>> Hi,
>>
>> The following series adds basic TPM2 support for OVMF-on-QEMU (I
>> haven't tested TPM1, for lack of interest). It links with the modules
>> to initializes the device in PEI phase, and do measurements (both PEI
>> and DXE). The Tcg2Dxe module provides the Tcg2 protocol which allows
>> the guest to access the measurement log and other facilities.
>>
>> DxeTpm2MeasureBootLib seems to do its job at measuring images that are
>> not measured in PEI phase (such as PCI PXE rom)
>>
>> Tcg2ConfigDxe is mostly interesting for debugging for now.
>>
>> A major lack is the support for Physical Present Interface (PPI, more
>> below).
>>
>> Linux guests seem to work fine. But windows guest generally complains
>> about the lack of PPI interface (most HLK tests require it, tpm.msc
>> admin interactions too). I haven't done "real" use-cases tests, as I
>> lack experience with TPM usage. Any help appreciated to test the TPM.
>>
>> Tcg2ConfigPei requires variable access, therefore
>> <https://bugzilla.tianocore.org/show_bug.cgi?id=386> must be solved
>> first. I used "[edk2] [PATCH v2 0/8] OvmfPkg: add the Variable PEIM,
>> defragment the UEFI memmap" as a base for this series.
>>
>> I build edk2 with:
>>
>> $ build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE  -DMEM_VARSTORE_EMU_ENABLE=FALSE
>>
>> I test with qemu & swtpm/libtpms (tpm2 branches, swtpm_setup.sh --tpm2 --tpm-state tpmstatedir)
>>
>> $ swtpm socket --tpmstate tpmstatedir --ctrl type=unixio,path=tpmsock  --tpm2 &
>> $ qemu .. -chardev socket,id=chrtpm,path=tpmsock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-crb,tpmdev=tpm0
> Thanks for this work -- extra thanks for the instructions regarding the
> software TPM backend.

Please use the tpm2-preview.v2 branch of swtpm and the 
tpm2-preview.rev146.v2 branch of libtpms. I had to change the way the 
state is serialized, so unfortunately you will also have to remove the 
tpm2-00.permall files.

    Stefan