Hi On Fri, Mar 9, 2018 at 2:09 PM, <marcandre.lur...@redhat.com> wrote: > From: Marc-André Lureau <marcandre.lur...@redhat.com> > > Hi, > > The following series adds basic TPM2 support for OVMF-on-QEMU (I > haven't tested TPM1, for lack of interest). It links with the modules > to initializes the device in PEI phase, and do measurements (both PEI > and DXE). The Tcg2Dxe module provides the Tcg2 protocol which allows > the guest to access the measurement log and other facilities. > > DxeTpm2MeasureBootLib seems to do its job at measuring images that are > not measured in PEI phase (such as PCI PXE rom) > > Tcg2ConfigDxe is not included due to its integration with edk2 own PPI > implementation which conflicts with qemu design. PPI design is still > being discussed & experimented at this point. > > Linux guests seem to work fine. But windows guest generally complains > about the lack of PPI interface (most HLK tests require it, tpm.msc > admin interactions too). I haven't done "real" use-cases tests, as I > lack experience with TPM usage. Any help appreciated to test the TPM. > > I build edk2 with: > > $ build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -DMEM_VARSTORE_EMU_ENABLE=FALSE > > I test with qemu & swtpm/libtpms (tpm2 branches, swtpm_setup.sh --tpm2 > --tpm-state tpmstatedir) > > $ swtpm socket --tpmstate tpmstatedir --ctrl type=unixio,path=tpmsock --tpm2 > & > $ qemu .. -chardev socket,id=chrtpm,path=tpmsock -tpmdev > emulator,id=tpm0,chardev=chrtpm -device tpm-crb,tpmdev=tpm0 > > Thanks > > Github tree: > https://github.com/elmarco/edk2/tree/tpm2 (tpm2-v2 tag)
I updated the github tree: https://github.com/elmarco/edk2/tree/tpm2 (tpm2-v3 tag) > > Related bug: > https://bugzilla.tianocore.org/show_bug.cgi?id=594 > > v3: after Laszlo review > - many simplifications to "add customized Tcg2ConfigPei clone" patch > - various move of fdf/dsc sections > - modify Ia32 & Ia32x64 fdf/dsc too > - modify commit messages > - add r-b tags > > v2: > - the series can now be applied to master directly, thanks to dropping > PeiReadOnlyVariable requirement > - remove the HOB list workaround, the main fix is now upstream. Add a > preliminary patch to complete it. > - removed traces of TPM1.2 support > - add own OvmfPkg Tcg2ConfigPei, which performs only TPM2 detection > - make PcdTpmInstanceGuid default all-bits-zero > - drop unneeded Pcd values > - explain why SHA1 is still nice to have (for 1.2 log format) > - drop Tcg2ConfigDxe > - more detailed commit messages, thanks to Laszlo explanations! > - rebased > > TODO: > - modify Ia32 and Ia32X64 builds This is now done. thanks > > Marc-André Lureau (7): > SecurityPkg/Tcg2Pei: drop PeiReadOnlyVariable from Depex > MdeModulePkg/Core/Pei: fix REGISITER -> REGISTER typo > OvmfPkg: simplify SecurityStubDxe.inf inclusion > OvmfPkg: add customized Tcg2ConfigPei clone > OvmfPkg: include Tcg2Pei module > OvmfPkg: include Tcg2Dxe module > OvmfPkg: plug DxeTpm2MeasureBootLib into SecurityStubDxe > > MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c | 18 ++-- > MdeModulePkg/Core/Pei/Image/Image.c | 4 +- > MdeModulePkg/Core/Pei/PeiMain.h | 2 +- > MdeModulePkg/Core/Pei/PeiMain/PeiMain.c | 2 +- > OvmfPkg/OvmfPkgIa32.dsc | 49 ++++++++++- > OvmfPkg/OvmfPkgIa32.fdf | 9 ++ > OvmfPkg/OvmfPkgIa32X64.dsc | 49 ++++++++++- > OvmfPkg/OvmfPkgIa32X64.fdf | 9 ++ > OvmfPkg/OvmfPkgX64.dsc | 49 ++++++++++- > OvmfPkg/OvmfPkgX64.fdf | 9 ++ > OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf | 53 ++++++++++++ > OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c | 84 +++++++++++++++++++ > SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf | 1 - > 13 files changed, 312 insertions(+), 26 deletions(-) > create mode 100644 OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf > create mode 100644 OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c > > -- > 2.16.2.346.g9779355e34 > > _______________________________________________ > edk2-devel mailing list > edk2-de...@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel -- Marc-André Lureau
