[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 0/7] RFC: ovmf: preliminary TPM2 support
From: |
marcandre . lureau |
Subject: |
[Qemu-devel] [PATCH 0/7] RFC: ovmf: preliminary TPM2 support |
Date: |
Fri, 23 Feb 2018 14:23:04 +0100 |
From: Marc-André Lureau <address@hidden>
Hi,
The following series adds basic TPM2 support for OVMF-on-QEMU (I
haven't tested TPM1, for lack of interest). It links with the modules
to initializes the device in PEI phase, and do measurements (both PEI
and DXE). The Tcg2Dxe module provides the Tcg2 protocol which allows
the guest to access the measurement log and other facilities.
DxeTpm2MeasureBootLib seems to do its job at measuring images that are
not measured in PEI phase (such as PCI PXE rom)
Tcg2ConfigDxe is mostly interesting for debugging for now.
A major lack is the support for Physical Present Interface (PPI, more
below).
Linux guests seem to work fine. But windows guest generally complains
about the lack of PPI interface (most HLK tests require it, tpm.msc
admin interactions too). I haven't done "real" use-cases tests, as I
lack experience with TPM usage. Any help appreciated to test the TPM.
Tcg2ConfigPei requires variable access, therefore
<https://bugzilla.tianocore.org/show_bug.cgi?id=386> must be solved
first. I used "[edk2] [PATCH v2 0/8] OvmfPkg: add the Variable PEIM,
defragment the UEFI memmap" as a base for this series.
I build edk2 with:
$ build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -DMEM_VARSTORE_EMU_ENABLE=FALSE
I test with qemu & swtpm/libtpms (tpm2 branches, swtpm_setup.sh --tpm2
--tpm-state tpmstatedir)
$ swtpm socket --tpmstate tpmstatedir --ctrl type=unixio,path=tpmsock --tpm2 &
$ qemu .. -chardev socket,id=chrtpm,path=tpmsock -tpmdev
emulator,id=tpm0,chardev=chrtpm -device tpm-crb,tpmdev=tpm0
PPI is problematic, because we generally don't want or need SMM, and
qemu is preferred to provide the ACPI tables. We therefore exclude
using Tcg2Smm for now (which also brings other problems). Stefan
Berger has been prototyping qemu code that provides PPI ACPI
interface, but there is some complication regarding memory location,
using a fixed address. My understanding is that the firmware
(seabios/edk2) should allocate the required memory itself (using qemu
linker script for ex) and patch the ACPI table. Then it's hopefully
only a matter of hooking Tcg2PhysicalPresenceLibProcessRequest() as
was done by Stefan in
https://github.com/stefanberger/edk2/commits/tpm2. The main problem I
see with this approach is that the location should remain stable
across reboots (not necessarily poweroff, edk2 uses nvram variables
for PPI flags). More investigation and help needed to support PPI!
Thanks
Related bug:
https://bugzilla.tianocore.org/show_bug.cgi?id=594
Marc-André Lureau (7):
SecurityPkg/Tcg2Pei: drop Tcg2PhysicalPresenceLib dependency
ovmf: link with Tcg2ConfigPei module
HACK: HobLib: workaround infinite loop
ovmf: link with Tcg2Pei module
ovmf: link with Tcg2Dxe module
ovmf: link with Tcg2ConfigDxe module
ovmf: add DxeTpm2MeasureBootLib
MdePkg/Library/PeiHobLib/HobLib.c | 4 +++
OvmfPkg/OvmfPkgX64.dsc | 49 ++++++++++++++++++++++++++++++++++++-
OvmfPkg/OvmfPkgX64.fdf | 9 +++++++
SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c | 2 --
SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf | 1 -
5 files changed, 61 insertions(+), 4 deletions(-)
--
2.16.1.73.g5832b7e9f2
- [Qemu-devel] [PATCH 0/7] RFC: ovmf: preliminary TPM2 support,
marcandre . lureau <=