[v6] Add support for TPM Physical Presence interface

[Qemu-devel] [PATCH v6 0/4] Add support for TPM Physical Presence interface

Posted by Marc-André Lureau 7 years, 5 months ago

Hi,

The following patches implement the TPM Physical Presence Interface
that allows a user to set a command via ACPI (sysfs entry in Linux)
that, upon the next reboot, the firmware looks for and acts upon by
sending sequences of commands to the TPM.

A dedicated memory region is added to the TPM CRB & TIS devices, at
address/size 0xFED45000/0x400. A new "etc/tpm/config" fw_cfg entry
holds the location for that PPI region and some version details, to
allow for future flexibility.

With the associated edk2/ovmf firmware, the Windows HLK "PPI 1.3" test
now runs successfully.

It is based on previous work from Stefan Berger ("[PATCH v2 0/4]
Implement Physical Presence interface for TPM 1.2 and 2")

The edk2 support is merged upstream.

v6: (see changeset in patches)
 - replace mmio region with ram
 - ASL code improvements
 - endianess fix on 8bit fw-cfg fields

v5:
 - more code documentation (Marc-André)
 - use some explicit named variables to ease reading (Marc-André)
 - use fixed size fields/memory regions, remove PPI struct (Marc-André)
 - only add PPI ACPI methods if PPI is enabled (Marc-André)
 - document the qemu/firmware ACPI memory region (Stefan)
 - remove the dummy ACPI memory clear interface patch

v4:
 - add a "ppi" property, default to true, unless machine <= 2.12
 - pass PPI address to tpm_ppi_init_io()
 - renamed tpm_ppi struct name

Marc-André Lureau (1):
  tpm: add a "ppi" boolean property

Stefan Berger (3):
  tpm: implement virtual memory device for TPM PPI
  acpi: add fw_cfg file for TPM and PPI virtual memory device
  acpi: build TPM Physical Presence interface

 hw/tpm/tpm_ppi.h      |  25 +++
 include/hw/acpi/tpm.h |  17 ++
 include/hw/compat.h   |  10 +
 hw/i386/acpi-build.c  | 420 +++++++++++++++++++++++++++++++++++++++++-
 hw/tpm/tpm_crb.c      |  11 ++
 hw/tpm/tpm_ppi.c      |  33 ++++
 hw/tpm/tpm_tis.c      |  11 ++
 docs/specs/tpm.txt    |  99 ++++++++++
 hw/tpm/Makefile.objs  |   2 +-
 hw/tpm/trace-events   |   4 +
 10 files changed, 629 insertions(+), 3 deletions(-)
 create mode 100644 hw/tpm/tpm_ppi.h
 create mode 100644 hw/tpm/tpm_ppi.c

-- 
2.18.0.rc1

Re: [Qemu-devel] [PATCH v6 0/4] Add support for TPM Physical Presence interface

Posted by Stefan Berger 7 years, 5 months ago

On 06/28/2018 01:26 PM, Marc-André Lureau wrote:
> Hi,
>
> The following patches implement the TPM Physical Presence Interface
> that allows a user to set a command via ACPI (sysfs entry in Linux)
> that, upon the next reboot, the firmware looks for and acts upon by
> sending sequences of commands to the TPM.
>
> A dedicated memory region is added to the TPM CRB & TIS devices, at
> address/size 0xFED45000/0x400. A new "etc/tpm/config" fw_cfg entry
> holds the location for that PPI region and some version details, to
> allow for future flexibility.
>
> With the associated edk2/ovmf firmware, the Windows HLK "PPI 1.3" test
> now runs successfully.
>
> It is based on previous work from Stefan Berger ("[PATCH v2 0/4]
> Implement Physical Presence interface for TPM 1.2 and 2")
>
> The edk2 support is merged upstream.

The least I could do now is test this... So, I tested this now with the 
SeaBIOS support I have for this series. It's here:

https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6

It works fine with at least an attached TPM 1.2. I haven't tried TPM 2 
yet but would not expect complications from QEMU level. A operation 
request value put into Linux's PPI interface can be read back also after 
a VM suspend / resume operation. The list of supported operations is 
shown correctly (needs Linux extensions for TPM 2 operation values 
beyond a certain number iirc). The request operation is executed 
correctly and the response shows the last operation and its result. So 
it seems to work fine.

    Stefan

Re: [Qemu-devel] [PATCH v6 0/4] Add support for TPM Physical Presence interface

Posted by Igor Mammedov 7 years, 5 months ago

On Fri, 29 Jun 2018 08:20:38 -0400
Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:

> On 06/28/2018 01:26 PM, Marc-André Lureau wrote:
> > Hi,
> >
> > The following patches implement the TPM Physical Presence Interface
> > that allows a user to set a command via ACPI (sysfs entry in Linux)
> > that, upon the next reboot, the firmware looks for and acts upon by
> > sending sequences of commands to the TPM.
> >
> > A dedicated memory region is added to the TPM CRB & TIS devices, at
> > address/size 0xFED45000/0x400. A new "etc/tpm/config" fw_cfg entry
> > holds the location for that PPI region and some version details, to
> > allow for future flexibility.
> >
> > With the associated edk2/ovmf firmware, the Windows HLK "PPI 1.3" test
> > now runs successfully.
> >
> > It is based on previous work from Stefan Berger ("[PATCH v2 0/4]
> > Implement Physical Presence interface for TPM 1.2 and 2")
> >
> > The edk2 support is merged upstream.  
> 
> The least I could do now is test this... So, I tested this now with the 
> SeaBIOS support I have for this series. It's here:
> 
> https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
> 
> It works fine with at least an attached TPM 1.2. I haven't tried TPM 2 
> yet but would not expect complications from QEMU level. A operation 
> request value put into Linux's PPI interface can be read back also after 
> a VM suspend / resume operation. The list of supported operations is 
> shown correctly (needs Linux extensions for TPM 2 operation values 
> beyond a certain number iirc). The request operation is executed 
> correctly and the response shows the last operation and its result. So 
> it seems to work fine.
> 
> 
>     Stefan
> 

Are there any instructions how to test it?

Re: [Qemu-devel] [PATCH v6 0/4] Add support for TPM Physical Presence interface

Posted by Stefan Berger 7 years, 5 months ago

On 07/02/2018 07:57 AM, Igor Mammedov wrote:
> On Fri, 29 Jun 2018 08:20:38 -0400
> Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
>
>> On 06/28/2018 01:26 PM, Marc-André Lureau wrote:
>>> Hi,
>>>
>>> The following patches implement the TPM Physical Presence Interface
>>> that allows a user to set a command via ACPI (sysfs entry in Linux)
>>> that, upon the next reboot, the firmware looks for and acts upon by
>>> sending sequences of commands to the TPM.
>>>
>>> A dedicated memory region is added to the TPM CRB & TIS devices, at
>>> address/size 0xFED45000/0x400. A new "etc/tpm/config" fw_cfg entry
>>> holds the location for that PPI region and some version details, to
>>> allow for future flexibility.
>>>
>>> With the associated edk2/ovmf firmware, the Windows HLK "PPI 1.3" test
>>> now runs successfully.
>>>
>>> It is based on previous work from Stefan Berger ("[PATCH v2 0/4]
>>> Implement Physical Presence interface for TPM 1.2 and 2")
>>>
>>> The edk2 support is merged upstream.
>> The least I could do now is test this... So, I tested this now with the
>> SeaBIOS support I have for this series. It's here:
>>
>> https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
>>
>> It works fine with at least an attached TPM 1.2. I haven't tried TPM 2
>> yet but would not expect complications from QEMU level. A operation
>> request value put into Linux's PPI interface can be read back also after
>> a VM suspend / resume operation. The list of supported operations is
>> shown correctly (needs Linux extensions for TPM 2 operation values
>> beyond a certain number iirc). The request operation is executed
>> correctly and the response shows the last operation and its result. So
>> it seems to work fine.
>>
>>
>>      Stefan
>>
> Are there any instructions how to test it?
>
1) You need to get swtpm running on a machine.

Build libtpms from the 'TPM 2 preview' branch here:

https://github.com/stefanberger/libtpms/tree/tpm2-preview.rev146.v2

Instructions are here: https://github.com/stefanberger/libtpms/wiki


Build swtpm from the TPM 2 preview branch here:

https://github.com/stefanberger/swtpm/tree/tpm2-preview.v2

Instructions are here: https://github.com/stefanberger/swtpm/wiki


2) Compile and install my branch of SeaBIOS with the PPI support:

branch is here: https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6


3) Follow the QEMU instructions for running the swtpm or start one using 
latest libvirt + latest virt-manager:

 From QEMU tree: docs/specs/tpm.txt  (starting line 255; this will start 
a TPM 1.2)


4) Inside the VM install 'trousers' and tpm-tools packages for using the 
TPM 1.2.


5) Find the TPM devices ppi directory and cd into it:

# find /sys/devices | grep ppi$

# cd /sys/device/pnp0/00:04/tpm/tpm0/ppi    # this is the location on my 
installation


6) Display the tcg_operations, PPI version, pending request, last 
response from firmware

# cat tcg_operations

0 4: User not required

1 4: User not required

2 4: User not required

3 4: User not required

[...]

# cat version

1.3

# cat request

0

# cat response

0: No Recent Request


7) Take ownership of the TPM

# tcsd

# tpm_takeownership -y -z


8) Check the state of the TPM:

# cat ../enabled ../active ../own

1

1

1


9) Request PPI to give up ownership of the TPM and activate and enable 
the TPM again; this is operation request '14' per table 1 of PPI 1.30 
specification.

# echo 14 > request
# cat request
14
# reboot

10) cd into the ppi directory after the reboot and check the state of 
the TPM

# cd /sys/device/pnp0/00:04/tpm/tpm0/ppi    # this is the location on my 
installation
# response
14 0: Success

# cat ../enabled ../active ../owned
1
1
0

I hope this helps.

Regards,
    Stefan

Re: [Qemu-devel] [PATCH v6 0/4] Add support for TPM Physical Presence interface

Posted by Igor Mammedov 7 years, 5 months ago

On Mon, 2 Jul 2018 10:54:13 -0400
Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:

> On 07/02/2018 07:57 AM, Igor Mammedov wrote:
> > On Fri, 29 Jun 2018 08:20:38 -0400
> > Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
> >  
> >> On 06/28/2018 01:26 PM, Marc-André Lureau wrote:  
> >>> Hi,
> >>>
> >>> The following patches implement the TPM Physical Presence Interface
> >>> that allows a user to set a command via ACPI (sysfs entry in Linux)
> >>> that, upon the next reboot, the firmware looks for and acts upon by
> >>> sending sequences of commands to the TPM.
> >>>
> >>> A dedicated memory region is added to the TPM CRB & TIS devices, at
> >>> address/size 0xFED45000/0x400. A new "etc/tpm/config" fw_cfg entry
> >>> holds the location for that PPI region and some version details, to
> >>> allow for future flexibility.
> >>>
> >>> With the associated edk2/ovmf firmware, the Windows HLK "PPI 1.3" test
> >>> now runs successfully.
> >>>
> >>> It is based on previous work from Stefan Berger ("[PATCH v2 0/4]
> >>> Implement Physical Presence interface for TPM 1.2 and 2")
> >>>
> >>> The edk2 support is merged upstream.  
> >> The least I could do now is test this... So, I tested this now with the
> >> SeaBIOS support I have for this series. It's here:
> >>
> >> https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
> >>
> >> It works fine with at least an attached TPM 1.2. I haven't tried TPM 2
> >> yet but would not expect complications from QEMU level. A operation
> >> request value put into Linux's PPI interface can be read back also after
> >> a VM suspend / resume operation. The list of supported operations is
> >> shown correctly (needs Linux extensions for TPM 2 operation values
> >> beyond a certain number iirc). The request operation is executed
> >> correctly and the response shows the last operation and its result. So
> >> it seems to work fine.
> >>
> >>
> >>      Stefan
> >>  
> > Are there any instructions how to test it?
> >  
> 1) You need to get swtpm running on a machine.
> 
> Build libtpms from the 'TPM 2 preview' branch here:
> 
> https://github.com/stefanberger/libtpms/tree/tpm2-preview.rev146.v2
> 
> Instructions are here: https://github.com/stefanberger/libtpms/wiki
> 
> 
> Build swtpm from the TPM 2 preview branch here:
> 
> https://github.com/stefanberger/swtpm/tree/tpm2-preview.v2
> 
> Instructions are here: https://github.com/stefanberger/swtpm/wiki
> 
> 
> 2) Compile and install my branch of SeaBIOS with the PPI support:
> 
> branch is here: https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
it looks like repo is gone, is it merged upstream?

Re: [Qemu-devel] [PATCH v6 0/4] Add support for TPM Physical Presence interface

Posted by Stefan Berger 7 years, 5 months ago

On 07/09/2018 10:05 AM, Igor Mammedov wrote:
> On Mon, 2 Jul 2018 10:54:13 -0400
> Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
>
>> On 07/02/2018 07:57 AM, Igor Mammedov wrote:
>>> On Fri, 29 Jun 2018 08:20:38 -0400
>>> Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
>>>   
>>>> On 06/28/2018 01:26 PM, Marc-André Lureau wrote:
>>>>> Hi,
>>>>>
>>>>> The following patches implement the TPM Physical Presence Interface
>>>>> that allows a user to set a command via ACPI (sysfs entry in Linux)
>>>>> that, upon the next reboot, the firmware looks for and acts upon by
>>>>> sending sequences of commands to the TPM.
>>>>>
>>>>> A dedicated memory region is added to the TPM CRB & TIS devices, at
>>>>> address/size 0xFED45000/0x400. A new "etc/tpm/config" fw_cfg entry
>>>>> holds the location for that PPI region and some version details, to
>>>>> allow for future flexibility.
>>>>>
>>>>> With the associated edk2/ovmf firmware, the Windows HLK "PPI 1.3" test
>>>>> now runs successfully.
>>>>>
>>>>> It is based on previous work from Stefan Berger ("[PATCH v2 0/4]
>>>>> Implement Physical Presence interface for TPM 1.2 and 2")
>>>>>
>>>>> The edk2 support is merged upstream.
>>>> The least I could do now is test this... So, I tested this now with the
>>>> SeaBIOS support I have for this series. It's here:
>>>>
>>>> https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
>>>>
>>>> It works fine with at least an attached TPM 1.2. I haven't tried TPM 2
>>>> yet but would not expect complications from QEMU level. A operation
>>>> request value put into Linux's PPI interface can be read back also after
>>>> a VM suspend / resume operation. The list of supported operations is
>>>> shown correctly (needs Linux extensions for TPM 2 operation values
>>>> beyond a certain number iirc). The request operation is executed
>>>> correctly and the response shows the last operation and its result. So
>>>> it seems to work fine.
>>>>
>>>>
>>>>       Stefan
>>>>   
>>> Are there any instructions how to test it?
>>>   
>> 1) You need to get swtpm running on a machine.
>>
>> Build libtpms from the 'TPM 2 preview' branch here:
>>
>> https://github.com/stefanberger/libtpms/tree/tpm2-preview.rev146.v2
>>
>> Instructions are here: https://github.com/stefanberger/libtpms/wiki
>>
>>
>> Build swtpm from the TPM 2 preview branch here:
>>
>> https://github.com/stefanberger/swtpm/tree/tpm2-preview.v2
>>
>> Instructions are here: https://github.com/stefanberger/swtpm/wiki
>>
>>
>> 2) Compile and install my branch of SeaBIOS with the PPI support:
>>
>> branch is here: https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
> it looks like repo is gone, is it merged upstream?
>
>
It's the following repo with the branch qemu-ppi.v6.


https://github.com/stefanberger/seabios-tpm


    Stefan

Re: [Qemu-devel] [PATCH v6 0/4] Add support for TPM Physical Presence interface

Posted by Igor Mammedov 7 years, 5 months ago

On Mon, 9 Jul 2018 10:07:46 -0400
Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:

> On 07/09/2018 10:05 AM, Igor Mammedov wrote:
> > On Mon, 2 Jul 2018 10:54:13 -0400
> > Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
> >  
> >> On 07/02/2018 07:57 AM, Igor Mammedov wrote:  
> >>> On Fri, 29 Jun 2018 08:20:38 -0400
> >>> Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
> >>>     
> >>>> On 06/28/2018 01:26 PM, Marc-André Lureau wrote:  
> >>>>> Hi,
> >>>>>
> >>>>> The following patches implement the TPM Physical Presence Interface
> >>>>> that allows a user to set a command via ACPI (sysfs entry in Linux)
> >>>>> that, upon the next reboot, the firmware looks for and acts upon by
> >>>>> sending sequences of commands to the TPM.
> >>>>>
> >>>>> A dedicated memory region is added to the TPM CRB & TIS devices, at
> >>>>> address/size 0xFED45000/0x400. A new "etc/tpm/config" fw_cfg entry
> >>>>> holds the location for that PPI region and some version details, to
> >>>>> allow for future flexibility.
> >>>>>
> >>>>> With the associated edk2/ovmf firmware, the Windows HLK "PPI 1.3" test
> >>>>> now runs successfully.
> >>>>>
> >>>>> It is based on previous work from Stefan Berger ("[PATCH v2 0/4]
> >>>>> Implement Physical Presence interface for TPM 1.2 and 2")
> >>>>>
> >>>>> The edk2 support is merged upstream.  
> >>>> The least I could do now is test this... So, I tested this now with the
> >>>> SeaBIOS support I have for this series. It's here:
> >>>>
> >>>> https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
> >>>>
> >>>> It works fine with at least an attached TPM 1.2. I haven't tried TPM 2
> >>>> yet but would not expect complications from QEMU level. A operation
> >>>> request value put into Linux's PPI interface can be read back also after
> >>>> a VM suspend / resume operation. The list of supported operations is
> >>>> shown correctly (needs Linux extensions for TPM 2 operation values
> >>>> beyond a certain number iirc). The request operation is executed
> >>>> correctly and the response shows the last operation and its result. So
> >>>> it seems to work fine.
> >>>>
> >>>>
> >>>>       Stefan
> >>>>     
> >>> Are there any instructions how to test it?
> >>>     
> >> 1) You need to get swtpm running on a machine.
> >>
> >> Build libtpms from the 'TPM 2 preview' branch here:
> >>
> >> https://github.com/stefanberger/libtpms/tree/tpm2-preview.rev146.v2
> >>
> >> Instructions are here: https://github.com/stefanberger/libtpms/wiki
> >>
> >>
> >> Build swtpm from the TPM 2 preview branch here:
> >>
> >> https://github.com/stefanberger/swtpm/tree/tpm2-preview.v2
> >>
> >> Instructions are here: https://github.com/stefanberger/swtpm/wiki
> >>
> >>
> >> 2) Compile and install my branch of SeaBIOS with the PPI support:
> >>
> >> branch is here: https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6  
> > it looks like repo is gone, is it merged upstream?
> >
> >  
> It's the following repo with the branch qemu-ppi.v6.
> 
> 
> https://github.com/stefanberger/seabios-tpm
Weird, I'm getting page not found.
(tried just your account without seabios-tpm, I see on full repos list qemu-tpm but nothing with ppi)

> 
>     Stefan
>

Re: [Qemu-devel] [PATCH v6 0/4] Add support for TPM Physical Presence interface

Posted by Stefan Berger 7 years, 5 months ago

On 07/09/2018 11:35 AM, Igor Mammedov wrote:
> On Mon, 9 Jul 2018 10:07:46 -0400
> Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
>
>> On 07/09/2018 10:05 AM, Igor Mammedov wrote:
>>> On Mon, 2 Jul 2018 10:54:13 -0400
>>> Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
>>>   
>>>> On 07/02/2018 07:57 AM, Igor Mammedov wrote:
>>>>> On Fri, 29 Jun 2018 08:20:38 -0400
>>>>> Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
>>>>>      
>>>>>> On 06/28/2018 01:26 PM, Marc-André Lureau wrote:
>>>>>>> Hi,
>>>>>>>
>>>>>>> The following patches implement the TPM Physical Presence Interface
>>>>>>> that allows a user to set a command via ACPI (sysfs entry in Linux)
>>>>>>> that, upon the next reboot, the firmware looks for and acts upon by
>>>>>>> sending sequences of commands to the TPM.
>>>>>>>
>>>>>>> A dedicated memory region is added to the TPM CRB & TIS devices, at
>>>>>>> address/size 0xFED45000/0x400. A new "etc/tpm/config" fw_cfg entry
>>>>>>> holds the location for that PPI region and some version details, to
>>>>>>> allow for future flexibility.
>>>>>>>
>>>>>>> With the associated edk2/ovmf firmware, the Windows HLK "PPI 1.3" test
>>>>>>> now runs successfully.
>>>>>>>
>>>>>>> It is based on previous work from Stefan Berger ("[PATCH v2 0/4]
>>>>>>> Implement Physical Presence interface for TPM 1.2 and 2")
>>>>>>>
>>>>>>> The edk2 support is merged upstream.
>>>>>> The least I could do now is test this... So, I tested this now with the
>>>>>> SeaBIOS support I have for this series. It's here:
>>>>>>
>>>>>> https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
>>>>>>
>>>>>> It works fine with at least an attached TPM 1.2. I haven't tried TPM 2
>>>>>> yet but would not expect complications from QEMU level. A operation
>>>>>> request value put into Linux's PPI interface can be read back also after
>>>>>> a VM suspend / resume operation. The list of supported operations is
>>>>>> shown correctly (needs Linux extensions for TPM 2 operation values
>>>>>> beyond a certain number iirc). The request operation is executed
>>>>>> correctly and the response shows the last operation and its result. So
>>>>>> it seems to work fine.
>>>>>>
>>>>>>
>>>>>>        Stefan
>>>>>>      
>>>>> Are there any instructions how to test it?
>>>>>      
>>>> 1) You need to get swtpm running on a machine.
>>>>
>>>> Build libtpms from the 'TPM 2 preview' branch here:
>>>>
>>>> https://github.com/stefanberger/libtpms/tree/tpm2-preview.rev146.v2
>>>>
>>>> Instructions are here: https://github.com/stefanberger/libtpms/wiki
>>>>
>>>>
>>>> Build swtpm from the TPM 2 preview branch here:
>>>>
>>>> https://github.com/stefanberger/swtpm/tree/tpm2-preview.v2
>>>>
>>>> Instructions are here: https://github.com/stefanberger/swtpm/wiki
>>>>
>>>>
>>>> 2) Compile and install my branch of SeaBIOS with the PPI support:
>>>>
>>>> branch is here: https://github.com/stefanberger/seabios-tpm/tree/qemu-ppi.v6
>>> it looks like repo is gone, is it merged upstream?
>>>
>>>   
>> It's the following repo with the branch qemu-ppi.v6.
>>
>>
>> https://github.com/stefanberger/seabios-tpm
> Weird, I'm getting page not found.
> (tried just your account without seabios-tpm, I see on full repos list qemu-tpm but nothing with ppi)

Forgot, it was a private repo. Now it's public.