| Message ID | 20230323030119.2113570-2-ninad@linux.ibm.com |
|---|---|
| State | New |
| Headers | show |
| Series | Add support for TPM devices over I2C bus | expand |
On 3/23/23 04:01, Ninad Palsule wrote: > This is a documentation change for I2C TPM device support. > > Qemu already supports devices attached to ISA and sysbus. > This drop adds support for the I2C bus attached TPM devices. > > Signed-off-by: Ninad Palsule <ninad@linux.ibm.com> > > --- > V2: > > Incorporated Stephen's review comments > - Added example in the document. > --- > docs/specs/tpm.rst | 20 +++++++++++++++++++- > 1 file changed, 19 insertions(+), 1 deletion(-) > > diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst > index 535912a92b..bf7249b09c 100644 > --- a/docs/specs/tpm.rst > +++ b/docs/specs/tpm.rst > @@ -21,11 +21,15 @@ QEMU files related to TPM TIS interface: > - ``hw/tpm/tpm_tis_common.c`` > - ``hw/tpm/tpm_tis_isa.c`` > - ``hw/tpm/tpm_tis_sysbus.c`` > + - ``hw/tpm/tpm_tis_i2c.c`` > - ``hw/tpm/tpm_tis.h`` > > Both an ISA device and a sysbus device are available. The former is > used with pc/q35 machine while the latter can be instantiated in the > -Arm virt machine. > +Arm virt machine. An I2C device support is also added which can be > +instantiated in the arm based emulation machine. An I2C device is also > +supported for the Arm virt machine. This device only supports the > +TPM 2 protocol. > > CRB interface > ------------- > @@ -348,6 +352,20 @@ In case an Arm virt machine is emulated, use the following command line: > -drive if=pflash,format=raw,file=flash0.img,readonly=on \ > -drive if=pflash,format=raw,file=flash1.img > > +In case a Rainier bmc machine is emulated, use the following command line: > + > +.. code-block:: console > + > + qemu-system-arm -M rainier-bmc -nographic \ > + -kernel ${IMAGEPATH}/fitImage-linux.bin \ > + -dtb ${IMAGEPATH}/aspeed-bmc-ibm-rainier.dtb \ > + -initrd ${IMAGEPATH}/obmc-phosphor-initramfs.rootfs.cpio.xz \ > + -drive file=${IMAGEPATH}/obmc-phosphor-image.rootfs.wic.qcow2,if=sd,index=2\ > + -net nic -net user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:2443-:443\ > + -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \ > + -tpmdev emulator,id=tpm0,chardev=chrtpm \ > + -device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e The rainier images are not the easiest to find. Could we use an AST2600 EVB machine instead and instantiate the device from user space ? see commit 3302184f7f or 7a7308eae0. Thanks, C. > In case SeaBIOS is used as firmware, it should show the TPM menu item > after entering the menu with 'ESC'. >
On 3/23/23 2:49 AM, Cédric Le Goater wrote: > On 3/23/23 04:01, Ninad Palsule wrote: >> This is a documentation change for I2C TPM device support. >> >> Qemu already supports devices attached to ISA and sysbus. >> This drop adds support for the I2C bus attached TPM devices. >> >> Signed-off-by: Ninad Palsule <ninad@linux.ibm.com> >> >> --- >> V2: >> >> Incorporated Stephen's review comments >> - Added example in the document. >> --- >> docs/specs/tpm.rst | 20 +++++++++++++++++++- >> 1 file changed, 19 insertions(+), 1 deletion(-) >> >> diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst >> index 535912a92b..bf7249b09c 100644 >> --- a/docs/specs/tpm.rst >> +++ b/docs/specs/tpm.rst >> @@ -21,11 +21,15 @@ QEMU files related to TPM TIS interface: >> - ``hw/tpm/tpm_tis_common.c`` >> - ``hw/tpm/tpm_tis_isa.c`` >> - ``hw/tpm/tpm_tis_sysbus.c`` >> + - ``hw/tpm/tpm_tis_i2c.c`` >> - ``hw/tpm/tpm_tis.h`` >> Both an ISA device and a sysbus device are available. The former is >> used with pc/q35 machine while the latter can be instantiated in the >> -Arm virt machine. >> +Arm virt machine. An I2C device support is also added which can be >> +instantiated in the arm based emulation machine. An I2C device is also >> +supported for the Arm virt machine. This device only supports the >> +TPM 2 protocol. >> CRB interface >> ------------- >> @@ -348,6 +352,20 @@ In case an Arm virt machine is emulated, use the >> following command line: >> -drive if=pflash,format=raw,file=flash0.img,readonly=on \ >> -drive if=pflash,format=raw,file=flash1.img >> +In case a Rainier bmc machine is emulated, use the following >> command line: >> + >> +.. code-block:: console >> + >> + qemu-system-arm -M rainier-bmc -nographic \ >> + -kernel ${IMAGEPATH}/fitImage-linux.bin \ >> + -dtb ${IMAGEPATH}/aspeed-bmc-ibm-rainier.dtb \ >> + -initrd ${IMAGEPATH}/obmc-phosphor-initramfs.rootfs.cpio.xz \ >> + -drive >> file=${IMAGEPATH}/obmc-phosphor-image.rootfs.wic.qcow2,if=sd,index=2\ >> + -net nic -net >> user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:2443-:443\ >> + -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \ >> + -tpmdev emulator,id=tpm0,chardev=chrtpm \ >> + -device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e > > > The rainier images are not the easiest to find. Could we use an > AST2600 EVB > machine instead and instantiate the device from user space ? see commit > 3302184f7f or 7a7308eae0. > Ok, I will check on AST2600 EVB machine. The rainier images are available here: https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/distro=ubuntu,label=docker-builder,target=p10bmc/artifact/openbmc/build/tmp/deploy/images/p10bmc/ Thanks for the review. Ninad > Thanks, > > C. > >> In case SeaBIOS is used as firmware, it should show the TPM menu item >> after entering the menu with 'ESC'. >
Hello Cedric, I tried to use ast2600-evb machine but it is not getting any message on I2C bus. Any suggestions? # Start the software TPM emulator. $ swtpm socket --tpmstate dir=/tmp/mytpm1 --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock --tpm2 --log level=100 # Start a qemu and point at swtpm. I am using i2c bus 12 and address 0x2e $ ~/qemu/build/qemu-system-arm -M ast2600-evb -nographic -kernel $IMAGEDIR/zImage -dtb $IMAGEDIR/aspeed-ast2600-evb.dtb -initrd $IMAGEDIR/rootfs.cpio -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e # Inside the ast2600-evb machine. Insantiated the device # echo 12 0x2e > /sys/bus/i2c/devices/i2c-12/new_device [ 158.265321] i2c i2c-12: new_device: Instantiated device 12 at 0x2e # Tried to instantiate TPM device but nothing happening on I2C bus. # echo 12-002e > /sys/bus/i2c/drivers/tpm_tis_i2c/bind sh: write error: No such device Thanks & Regards, Ninad Palsule On 3/23/23 2:49 AM, Cédric Le Goater wrote: > On 3/23/23 04:01, Ninad Palsule wrote: >> This is a documentation change for I2C TPM device support. >> >> Qemu already supports devices attached to ISA and sysbus. >> This drop adds support for the I2C bus attached TPM devices. >> >> Signed-off-by: Ninad Palsule <ninad@linux.ibm.com> >> >> --- >> V2: >> >> Incorporated Stephen's review comments >> - Added example in the document. >> --- >> docs/specs/tpm.rst | 20 +++++++++++++++++++- >> 1 file changed, 19 insertions(+), 1 deletion(-) >> >> diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst >> index 535912a92b..bf7249b09c 100644 >> --- a/docs/specs/tpm.rst >> +++ b/docs/specs/tpm.rst >> @@ -21,11 +21,15 @@ QEMU files related to TPM TIS interface: >> - ``hw/tpm/tpm_tis_common.c`` >> - ``hw/tpm/tpm_tis_isa.c`` >> - ``hw/tpm/tpm_tis_sysbus.c`` >> + - ``hw/tpm/tpm_tis_i2c.c`` >> - ``hw/tpm/tpm_tis.h`` >> Both an ISA device and a sysbus device are available. The former is >> used with pc/q35 machine while the latter can be instantiated in the >> -Arm virt machine. >> +Arm virt machine. An I2C device support is also added which can be >> +instantiated in the arm based emulation machine. An I2C device is also >> +supported for the Arm virt machine. This device only supports the >> +TPM 2 protocol. >> CRB interface >> ------------- >> @@ -348,6 +352,20 @@ In case an Arm virt machine is emulated, use the >> following command line: >> -drive if=pflash,format=raw,file=flash0.img,readonly=on \ >> -drive if=pflash,format=raw,file=flash1.img >> +In case a Rainier bmc machine is emulated, use the following >> command line: >> + >> +.. code-block:: console >> + >> + qemu-system-arm -M rainier-bmc -nographic \ >> + -kernel ${IMAGEPATH}/fitImage-linux.bin \ >> + -dtb ${IMAGEPATH}/aspeed-bmc-ibm-rainier.dtb \ >> + -initrd ${IMAGEPATH}/obmc-phosphor-initramfs.rootfs.cpio.xz \ >> + -drive >> file=${IMAGEPATH}/obmc-phosphor-image.rootfs.wic.qcow2,if=sd,index=2\ >> + -net nic -net >> user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:2443-:443\ >> + -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \ >> + -tpmdev emulator,id=tpm0,chardev=chrtpm \ >> + -device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e > > > The rainier images are not the easiest to find. Could we use an > AST2600 EVB > machine instead and instantiate the device from user space ? see commit > 3302184f7f or 7a7308eae0. > > Thanks, > > C. > >> In case SeaBIOS is used as firmware, it should show the TPM menu item >> after entering the menu with 'ESC'. >
Hello Cedric, Joel helped me to configure the device and we are able to configure tpm device on ast2600-evb. I will include this example in the documentation. # uname -a Linux ast2600-evb 6.1.15 #1 SMP Thu Mar 23 20:48:29 CDT 2023 armv7l GNU/Linux # cat /etc/os-release NAME=Buildroot VERSION=2023.02-dirty ID=buildroot VERSION_ID=2023.02 PRETTY_NAME="Buildroot 2023.02" # echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device [ 59.681684] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1) [ 59.703190] tpm tpm0: A TPM error (256) occurred attempting the self test [ 59.705215] tpm tpm0: starting up the TPM manually [ 59.892917] i2c i2c-12: new_device: Instantiated device tpm_tis_i2c at 0x2e # cd /sys/class/tpm/tpm0 # ls dev pcr-sha256 power uevent device pcr-sha384 subsystem pcr-sha1 pcr-sha512 tpm_version_major On 3/23/23 10:23 PM, Ninad Palsule wrote: > Hello Cedric, > > I tried to use ast2600-evb machine but it is not getting any message > on I2C bus. > > Any suggestions? > > # Start the software TPM emulator. > $ swtpm socket --tpmstate dir=/tmp/mytpm1 --ctrl > type=unixio,path=/tmp/mytpm1/swtpm-sock --tpm2 --log level=100 > > # Start a qemu and point at swtpm. I am using i2c bus 12 and address 0x2e > $ ~/qemu/build/qemu-system-arm -M ast2600-evb -nographic -kernel > $IMAGEDIR/zImage -dtb $IMAGEDIR/aspeed-ast2600-evb.dtb -initrd > $IMAGEDIR/rootfs.cpio -chardev > socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock -tpmdev > emulator,id=tpm0,chardev=chrtpm -device > tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e > > # Inside the ast2600-evb machine. Insantiated the device > # echo 12 0x2e > /sys/bus/i2c/devices/i2c-12/new_device > [ 158.265321] i2c i2c-12: new_device: Instantiated device 12 at 0x2e > > # Tried to instantiate TPM device but nothing happening on I2C bus. > # echo 12-002e > /sys/bus/i2c/drivers/tpm_tis_i2c/bind > sh: write error: No such device > > Thanks & Regards, > > Ninad Palsule > > On 3/23/23 2:49 AM, Cédric Le Goater wrote: >> On 3/23/23 04:01, Ninad Palsule wrote: >>> This is a documentation change for I2C TPM device support. >>> >>> Qemu already supports devices attached to ISA and sysbus. >>> This drop adds support for the I2C bus attached TPM devices. >>> >>> Signed-off-by: Ninad Palsule <ninad@linux.ibm.com> >>> >>> --- >>> V2: >>> >>> Incorporated Stephen's review comments >>> - Added example in the document. >>> --- >>> docs/specs/tpm.rst | 20 +++++++++++++++++++- >>> 1 file changed, 19 insertions(+), 1 deletion(-) >>> >>> diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst >>> index 535912a92b..bf7249b09c 100644 >>> --- a/docs/specs/tpm.rst >>> +++ b/docs/specs/tpm.rst >>> @@ -21,11 +21,15 @@ QEMU files related to TPM TIS interface: >>> - ``hw/tpm/tpm_tis_common.c`` >>> - ``hw/tpm/tpm_tis_isa.c`` >>> - ``hw/tpm/tpm_tis_sysbus.c`` >>> + - ``hw/tpm/tpm_tis_i2c.c`` >>> - ``hw/tpm/tpm_tis.h`` >>> Both an ISA device and a sysbus device are available. The former is >>> used with pc/q35 machine while the latter can be instantiated in the >>> -Arm virt machine. >>> +Arm virt machine. An I2C device support is also added which can be >>> +instantiated in the arm based emulation machine. An I2C device is also >>> +supported for the Arm virt machine. This device only supports the >>> +TPM 2 protocol. >>> CRB interface >>> ------------- >>> @@ -348,6 +352,20 @@ In case an Arm virt machine is emulated, use >>> the following command line: >>> -drive if=pflash,format=raw,file=flash0.img,readonly=on \ >>> -drive if=pflash,format=raw,file=flash1.img >>> +In case a Rainier bmc machine is emulated, use the following >>> command line: >>> + >>> +.. code-block:: console >>> + >>> + qemu-system-arm -M rainier-bmc -nographic \ >>> + -kernel ${IMAGEPATH}/fitImage-linux.bin \ >>> + -dtb ${IMAGEPATH}/aspeed-bmc-ibm-rainier.dtb \ >>> + -initrd ${IMAGEPATH}/obmc-phosphor-initramfs.rootfs.cpio.xz \ >>> + -drive >>> file=${IMAGEPATH}/obmc-phosphor-image.rootfs.wic.qcow2,if=sd,index=2\ >>> + -net nic -net >>> user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:2443-:443\ >>> + -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \ >>> + -tpmdev emulator,id=tpm0,chardev=chrtpm \ >>> + -device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e >> >> >> The rainier images are not the easiest to find. Could we use an >> AST2600 EVB >> machine instead and instantiate the device from user space ? see commit >> 3302184f7f or 7a7308eae0. >> >> Thanks, >> >> C. >> >>> In case SeaBIOS is used as firmware, it should show the TPM menu item >>> after entering the menu with 'ESC'. >>
On 3/24/23 06:11, Ninad Palsule wrote: > Hello Cedric, > > Joel helped me to configure the device and we are able to configure tpm device on ast2600-evb. > > I will include this example in the documentation. > > # uname -a > Linux ast2600-evb 6.1.15 #1 SMP Thu Mar 23 20:48:29 CDT 2023 armv7l GNU/Linux > # cat /etc/os-release > NAME=Buildroot > VERSION=2023.02-dirty > ID=buildroot > VERSION_ID=2023.02 > PRETTY_NAME="Buildroot 2023.02" > > # echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device > [ 59.681684] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1) > [ 59.703190] tpm tpm0: A TPM error (256) occurred attempting the self test > [ 59.705215] tpm tpm0: starting up the TPM manually > [ 59.892917] i2c i2c-12: new_device: Instantiated device tpm_tis_i2c at 0x2e > # cd /sys/class/tpm/tpm0 > # ls > dev pcr-sha256 power uevent > device pcr-sha384 subsystem > pcr-sha1 pcr-sha512 tpm_version_major Nice. Did you need any special support in the kernel ? I could update this image for avocado tests : https://github.com/legoater/qemu-aspeed-boot/tree/master/images/ast2600-evb/buildroot-2023.02 Thanks, C.
On 3/24/23 3:01 AM, Cédric Le Goater wrote: > On 3/24/23 06:11, Ninad Palsule wrote: >> Hello Cedric, >> >> Joel helped me to configure the device and we are able to configure >> tpm device on ast2600-evb. >> >> I will include this example in the documentation. >> >> # uname -a >> Linux ast2600-evb 6.1.15 #1 SMP Thu Mar 23 20:48:29 CDT 2023 armv7l >> GNU/Linux >> # cat /etc/os-release >> NAME=Buildroot >> VERSION=2023.02-dirty >> ID=buildroot >> VERSION_ID=2023.02 >> PRETTY_NAME="Buildroot 2023.02" >> >> # echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device >> [ 59.681684] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1) >> [ 59.703190] tpm tpm0: A TPM error (256) occurred attempting the >> self test >> [ 59.705215] tpm tpm0: starting up the TPM manually >> [ 59.892917] i2c i2c-12: new_device: Instantiated device >> tpm_tis_i2c at 0x2e >> # cd /sys/class/tpm/tpm0 >> # ls >> dev pcr-sha256 power uevent >> device pcr-sha384 subsystem >> pcr-sha1 pcr-sha512 tpm_version_major > > > Nice. Did you need any special support in the kernel ? > > I could update this image for avocado tests : > > https://github.com/legoater/qemu-aspeed-boot/tree/master/images/ast2600-evb/buildroot-2023.02 Kernel need a TPM i2c driver support. I built it with following head on dev-6.1 branch. You also need to run "echo" command I mentioned above to instantiate the device. Also start the swtpm as provided in my earlier mail. $ git rev-parse HEAD 0e94476a8892056a9242bcd75e59e7d2b92ac435 Thanks, Ninad > > Thanks, > > C.
diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst index 535912a92b..bf7249b09c 100644 --- a/docs/specs/tpm.rst +++ b/docs/specs/tpm.rst @@ -21,11 +21,15 @@ QEMU files related to TPM TIS interface: - ``hw/tpm/tpm_tis_common.c`` - ``hw/tpm/tpm_tis_isa.c`` - ``hw/tpm/tpm_tis_sysbus.c`` + - ``hw/tpm/tpm_tis_i2c.c`` - ``hw/tpm/tpm_tis.h`` Both an ISA device and a sysbus device are available. The former is used with pc/q35 machine while the latter can be instantiated in the -Arm virt machine. +Arm virt machine. An I2C device support is also added which can be +instantiated in the arm based emulation machine. An I2C device is also +supported for the Arm virt machine. This device only supports the +TPM 2 protocol. CRB interface ------------- @@ -348,6 +352,20 @@ In case an Arm virt machine is emulated, use the following command line: -drive if=pflash,format=raw,file=flash0.img,readonly=on \ -drive if=pflash,format=raw,file=flash1.img +In case a Rainier bmc machine is emulated, use the following command line: + +.. code-block:: console + + qemu-system-arm -M rainier-bmc -nographic \ + -kernel ${IMAGEPATH}/fitImage-linux.bin \ + -dtb ${IMAGEPATH}/aspeed-bmc-ibm-rainier.dtb \ + -initrd ${IMAGEPATH}/obmc-phosphor-initramfs.rootfs.cpio.xz \ + -drive file=${IMAGEPATH}/obmc-phosphor-image.rootfs.wic.qcow2,if=sd,index=2\ + -net nic -net user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:2443-:443\ + -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \ + -tpmdev emulator,id=tpm0,chardev=chrtpm \ + -device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e + In case SeaBIOS is used as firmware, it should show the TPM menu item after entering the menu with 'ESC'.
This is a documentation change for I2C TPM device support. Qemu already supports devices attached to ISA and sysbus. This drop adds support for the I2C bus attached TPM devices. Signed-off-by: Ninad Palsule <ninad@linux.ibm.com> --- V2: Incorporated Stephen's review comments - Added example in the document. --- docs/specs/tpm.rst | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)