biergaizi
commented
6 years ago Documentation: https://github.com/qemu/qemu/blob/master/docs/specs/tpm.txt
The TPM device is defined with ACPI ID "PNP0C31". QEMU builds a SSDT and passes it into the guest through the fw_cfg device. The device description contains the base address of the TIS interface 0xfed40000 and the size of the MMIO area (0x5000). In case a TPM2 is used by QEMU, a TPM2 ACPI table is also provided. The device is described to be used in polling mode rather than interrupt mode primarily because no unused IRQ could be found.
The swtpm program behaves like a hardware TPM and therefore needs to be initialized by the firmware running inside the QEMU virtual machine. One necessary step for initializing the device is to send the TPM_Startup command to it. SeaBIOS, for example, has been instrumented to initialize a TPM 1.2 or TPM 2 device using this command.
Apparently the TPM was not detected because the hardware was never initialized. I patched the source code of coreboot to select the LPC_TPM driver for Q35 board in coreboot, and enabled TPM and measured boot. But the TPM still fails to work.
TPM: pcr 3 measure 00090000 @ 4224: 61dda497607f8802039a5c8d4654a25040f21a9f
lpc_tpm: Read reg 0x18 returns 0xff
lpc_tpm: Read reg 0x19 returns 0xffff
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0xc1
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x22
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x14
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x0
lpc_tpm: Write reg 0x18 with 0x3
lpc_tpm: Write reg 0x18 with 0x61
lpc_tpm: Write reg 0x18 with 0xdd
lpc_tpm: Write reg 0x18 with 0xa4
lpc_tpm: Write reg 0x18 with 0x97
lpc_tpm: Write reg 0x18 with 0x60
lpc_tpm: Write reg 0x18 with 0x7f
lpc_tpm: Write reg 0x18 with 0x88
lpc_tpm: Write reg 0x18 with 0x2
lpc_tpm: Write reg 0x18 with 0x3
lpc_tpm: Write reg 0x18 with 0x9a
lpc_tpm: Write reg 0x18 with 0x5c
lpc_tpm: Write reg 0x18 with 0x8d
lpc_tpm: Write reg 0x18 with 0x46
lpc_tpm: Write reg 0x18 with 0x54
lpc_tpm: Write reg 0x18 with 0xa2
lpc_tpm: Write reg 0x18 with 0x50
lpc_tpm: Write reg 0x18 with 0x40
lpc_tpm: Write reg 0x18 with 0xf2
lpc_tpm: Write reg 0x18 with 0x1a
lpc_tpm: Read reg 0x18 returns 0xff
lpc_tpm: Read reg 0x18 returns 0xff
lpc_tpm: Read reg 0x19 returns 0xffff
lpc_tpm: Write reg 0x18 with 0x9f
lpc_tpm: Read reg 0x18 returns 0xff
lpc_tpm: Read reg 0x18 returns 0xff
lpc_tpm: Read reg 0x18 returns 0xff
src/drivers/pc80/tpm/tpm.c:515 unexpected TPM status 0xff
src/drivers/pc80/tpm/tpm.c:703 failed sending data to TPM
TPM: command 0x14 send/receive failed: 0x10000001Any tip on how to initialize the TPM?
tlaurion
Since QEMU 2.11, TPM-related code has been merged and it's now possible to simulate a TPM hardware with swtpm and QEMU.
On SeaBIOS, the TPM is detected and usable under Linux-based system, with kernel module
tpm_tis, shown as/dev/tpm0.However, for mysterious reasons, the TPM is only detectable on SeaBIOS, but not HEADS. There's no TPM device under
/dev, nor any TPM-related information in dmesg. We need to investigate the cause of the issue is an incomplete TPM implemenation in QEMU/swtpm or something else.Having a working TPM-simulation would ease the development significantly.