[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [edk2] [PATCH v3 0/7] ovmf: preliminary TPM2 support
From: |
Marc-André Lureau |
Subject: |
Re: [Qemu-devel] [edk2] [PATCH v3 0/7] ovmf: preliminary TPM2 support |
Date: |
Fri, 9 Mar 2018 14:59:44 +0100 |
Hi
On Fri, Mar 9, 2018 at 2:09 PM, <address@hidden> wrote:
> From: Marc-André Lureau <address@hidden>
>
> Hi,
>
> The following series adds basic TPM2 support for OVMF-on-QEMU (I
> haven't tested TPM1, for lack of interest). It links with the modules
> to initializes the device in PEI phase, and do measurements (both PEI
> and DXE). The Tcg2Dxe module provides the Tcg2 protocol which allows
> the guest to access the measurement log and other facilities.
>
> DxeTpm2MeasureBootLib seems to do its job at measuring images that are
> not measured in PEI phase (such as PCI PXE rom)
>
> Tcg2ConfigDxe is not included due to its integration with edk2 own PPI
> implementation which conflicts with qemu design. PPI design is still
> being discussed & experimented at this point.
>
> Linux guests seem to work fine. But windows guest generally complains
> about the lack of PPI interface (most HLK tests require it, tpm.msc
> admin interactions too). I haven't done "real" use-cases tests, as I
> lack experience with TPM usage. Any help appreciated to test the TPM.
>
> I build edk2 with:
>
> $ build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -DMEM_VARSTORE_EMU_ENABLE=FALSE
>
> I test with qemu & swtpm/libtpms (tpm2 branches, swtpm_setup.sh --tpm2
> --tpm-state tpmstatedir)
>
> $ swtpm socket --tpmstate tpmstatedir --ctrl type=unixio,path=tpmsock --tpm2
> &
> $ qemu .. -chardev socket,id=chrtpm,path=tpmsock -tpmdev
> emulator,id=tpm0,chardev=chrtpm -device tpm-crb,tpmdev=tpm0
>
> Thanks
>
> Github tree:
> https://github.com/elmarco/edk2/tree/tpm2 (tpm2-v2 tag)
I updated the github tree:
https://github.com/elmarco/edk2/tree/tpm2 (tpm2-v3 tag)
>
> Related bug:
> https://bugzilla.tianocore.org/show_bug.cgi?id=594
>
> v3: after Laszlo review
> - many simplifications to "add customized Tcg2ConfigPei clone" patch
> - various move of fdf/dsc sections
> - modify Ia32 & Ia32x64 fdf/dsc too
> - modify commit messages
> - add r-b tags
>
> v2:
> - the series can now be applied to master directly, thanks to dropping
> PeiReadOnlyVariable requirement
> - remove the HOB list workaround, the main fix is now upstream. Add a
> preliminary patch to complete it.
> - removed traces of TPM1.2 support
> - add own OvmfPkg Tcg2ConfigPei, which performs only TPM2 detection
> - make PcdTpmInstanceGuid default all-bits-zero
> - drop unneeded Pcd values
> - explain why SHA1 is still nice to have (for 1.2 log format)
> - drop Tcg2ConfigDxe
> - more detailed commit messages, thanks to Laszlo explanations!
> - rebased
>
> TODO:
> - modify Ia32 and Ia32X64 builds
This is now done.
thanks
>
> Marc-André Lureau (7):
> SecurityPkg/Tcg2Pei: drop PeiReadOnlyVariable from Depex
> MdeModulePkg/Core/Pei: fix REGISITER -> REGISTER typo
> OvmfPkg: simplify SecurityStubDxe.inf inclusion
> OvmfPkg: add customized Tcg2ConfigPei clone
> OvmfPkg: include Tcg2Pei module
> OvmfPkg: include Tcg2Dxe module
> OvmfPkg: plug DxeTpm2MeasureBootLib into SecurityStubDxe
>
> MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c | 18 ++--
> MdeModulePkg/Core/Pei/Image/Image.c | 4 +-
> MdeModulePkg/Core/Pei/PeiMain.h | 2 +-
> MdeModulePkg/Core/Pei/PeiMain/PeiMain.c | 2 +-
> OvmfPkg/OvmfPkgIa32.dsc | 49 ++++++++++-
> OvmfPkg/OvmfPkgIa32.fdf | 9 ++
> OvmfPkg/OvmfPkgIa32X64.dsc | 49 ++++++++++-
> OvmfPkg/OvmfPkgIa32X64.fdf | 9 ++
> OvmfPkg/OvmfPkgX64.dsc | 49 ++++++++++-
> OvmfPkg/OvmfPkgX64.fdf | 9 ++
> OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf | 53 ++++++++++++
> OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c | 84 +++++++++++++++++++
> SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf | 1 -
> 13 files changed, 312 insertions(+), 26 deletions(-)
> create mode 100644 OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf
> create mode 100644 OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPeim.c
>
> --
> 2.16.2.346.g9779355e34
>
> _______________________________________________
> edk2-devel mailing list
> address@hidden
> https://lists.01.org/mailman/listinfo/edk2-devel
--
Marc-André Lureau
- [Qemu-devel] [PATCH v3 3/7] OvmfPkg: simplify SecurityStubDxe.inf inclusion, (continued)
- [Qemu-devel] [PATCH v3 3/7] OvmfPkg: simplify SecurityStubDxe.inf inclusion, marcandre . lureau, 2018/03/09
- [Qemu-devel] [PATCH v3 2/7] MdeModulePkg/Core/Pei: fix REGISITER -> REGISTER typo, marcandre . lureau, 2018/03/09
- [Qemu-devel] [PATCH v3 5/7] OvmfPkg: include Tcg2Pei module, marcandre . lureau, 2018/03/09
- [Qemu-devel] [PATCH v3 4/7] OvmfPkg: add customized Tcg2ConfigPei clone, marcandre . lureau, 2018/03/09
- [Qemu-devel] [PATCH v3 6/7] OvmfPkg: include Tcg2Dxe module, marcandre . lureau, 2018/03/09
- [Qemu-devel] [PATCH v3 7/7] OvmfPkg: plug DxeTpm2MeasureBootLib into SecurityStubDxe, marcandre . lureau, 2018/03/09
- Re: [Qemu-devel] [edk2] [PATCH v3 0/7] ovmf: preliminary TPM2 support,
Marc-André Lureau <=
- Re: [Qemu-devel] [edk2] [PATCH v3 0/7] ovmf: preliminary TPM2 support, Laszlo Ersek, 2018/03/09