Integrating swtpm(as a software TPM) with OpenBMC on Qemu
Sandeep Kumar
sandeep.pkumar at tcs.com
Tue May 23 15:59:41 AEST 2023
TCS Confidential
Hi Stefan,
Thanks for the information. I am trying to make use of the commands by using tpm_init() inside image-fit.c file. It compiles but gives an undefined reference error as below.
gcc -isystem/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/work/evb_ast2600-openbmc-linux-gnueabi/u-boot-aspeed-sdk/1_v2019.04+gitAUTOINC+fd915728e1-r0/recipe-sysroot-native/usr/include -O2 -pipe -L/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/work/evb_ast2600-openbmc-linux-gnueabi/u-boot-aspeed-sdk/1_v2019.04+gitAUTOINC+fd915728e1-r0/recipe-sysroot-native/usr/lib -L/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/work/evb_ast2600-openbmc-linux-gnueabi/u-boot-aspeed-sdk/1_v2019.04+gitAUTOINC+fd915728e1-r0/recipe-sysroot-native/lib -Wl,--enable-new-dtags -Wl,-rpath-link,/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/work/evb_ast2600-openbmc-linux-gnueabi/u-boot-aspeed-sdk/1_v2019.04+gitAUTOINC+fd915728e1-r0/recipe-sysroot-native/usr/lib -Wl,-rpath-link,/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/work/evb_ast2600-openbmc-linux-gnueabi/u-boot-aspeed-sdk/1_v2019.04+gitAUTOINC+fd915728e1-r0/recipe-sysroot-native/lib -Wl,-rpath,/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/work/evb_ast2600-openbmc-linux-gnueabi/u-boot-aspeed-sdk/1_v2019.04+gitAUTOINC+fd915728e1-r0/recipe-sysroot-native/usr/lib -Wl,-rpath,/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/work/evb_ast2600-openbmc-linux-gnueabi/u-boot-aspeed-sdk/1_v2019.04+gitAUTOINC+fd915728e1-r0/recipe-sysroot-native/lib -Wl,-O1 -o tools/fit_check_sign tools/aisimage.o tools/atmelimage.o tools/common/image-sig.o tools/common/bootm.o tools/lib/crc32.o tools/default_image.o tools/lib/fdtdec_common.o tools/lib/fdtdec.o tools/fit_common.o tools/fit_image.o tools/common/image-fit.o tools/image-host.o tools/common/image.o tools/imagetool.o tools/imximage.o tools/imx8image.o tools/imx8mimage.o tools/kwbimage.o tools/lib/md5.o tools/lpc32xximage.o tools/mxsimage.o tools/omapimage.o tools/os_support.o tools/pblimage.o tools/pbl_crc32.o tools/vybridimage.o tools/stm32image.o tools/lib/rc4.o tools/rkcommon.o tools/rkimage.o tools/rksd.o tools/rkspi.o tools/socfpgaimage.o tools/lib/crc16.o tools/lib/sha1.o tools/lib/sha256.o tools/lib/sha512.o tools/common/hash.o tools/ublimage.o tools/zynqimage.o tools/zynqmpimage.o tools/zynqmpbif.o tools/libfdt/fdt.o tools/libfdt/fdt_wip.o tools/libfdt/fdt_sw.o tools/libfdt/fdt_rw.o tools/libfdt/fdt_strerror.o tools/libfdt/fdt_empty_tree.o tools/libfdt/fdt_addresses.o tools/libfdt/fdt_overlay.o tools/lib/libfdt/fdt_ro.o tools/lib/libfdt/fdt_region.o tools/gpimage.o tools/gpimage-common.o tools/mtk_image.o tools/lib/rsa/rsa-sign.o tools/lib/rsa/rsa-verify.o tools/lib/rsa/rsa-checksum.o tools/lib/rsa/rsa-mod-exp.o tools/fit_check_sign.o -lssl -lcrypto
/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/hosttools/ld: tools/common/image-fit.o: in function `boot_get_setup_fit':
image-fit.c:(.text+0x27e1): undefined reference to `get_tpm'
/home/tcs/work/san/openbmc/openbmc_april/openbmc/build/evb-ast2600/tmp/hosttools/ld: image-fit.c:(.text+0x280e): undefined reference to `tpm_init'
collect2: error: ld returned 1 exit status
make[2]: *** [scripts/Makefile.host:106: tools/dumpimage] Error 1
Although the tpm_init() is present in tpm-common.c and image-fit.c is present in the same module as well. But still I get the above error. I have tried including the DEPENDS on libtpm in the u-boot recipe but nothing seems to work. Any specific library/specific location to be included for TPM support?
-----Original Message-----
From: Stefan Berger <stefanb at linux.ibm.com>
Sent: Thursday, May 18, 2023 5:10 PM
To: Sandeep Kumar <sandeep.pkumar at tcs.com>; Cédric Le Goater <clg at kaod.org>; openbmc at lists.ozlabs.org; Ninad Palsule <ninad at linux.ibm.com>; Joel Stanley <jms at jms.id.au>; Andrew Jeffery <andrew at aj.id.au>
Subject: Re: Integrating swtpm(as a software TPM) with OpenBMC on Qemu
"External email. Open with Caution"
On 5/17/23 13:13, Sandeep Kumar wrote:
> TCS Confidential
>
> Hi Stefan,
>
> Thanks for providing the information. I am able to make use of it. But is it possible to make use of this stack at the bootloader(inside u-boot) level ?
>
There are quite a few commands in u-boot:
ast# tpm2
tpm2 - Issue a TPMv2.x command
Usage:
tpm2 <command> [<arguments>]
device [num device]
Show all devices or set the specified device info
Show information about the TPM.
state
Show internal state from the TPM (if available) init
Initialize the software stack. Always the first command to issue.
startup <mode>
Issue a TPM2_Startup command.
<mode> is one of:
* TPM2_SU_CLEAR (reset state)
* TPM2_SU_STATE (preserved state) self_test <type>
Test the TPM capabilities.
<type> is one of:
* full (perform all tests)
* continue (only check untested tests) clear <hierarchy>
Issue a TPM2_Clear command.
<hierarchy> is one of:
* TPM2_RH_LOCKOUT
* TPM2_RH_PLATFORM
pcr_extend <pcr> <digest_addr>
Extend PCR #<pcr> with digest at <digest_addr>.
<pcr>: index of the PCR
<digest_addr>: address of a 32-byte SHA256 digest pcr_read <pcr> <digest_addr>
Read PCR #<pcr> to memory address <digest_addr>.
<pcr>: index of the PCR
<digest_addr>: address to store the a 32-byte SHA256 digest get_capability <capability> <property> <addr> <count>
Read and display <count> entries indexed by <capability>/<property>.
Values are 4 bytes long and are written at <addr>.
<capability>: capability
<property>: property
<addr>: address to store <count> entries of 4 bytes
<count>: number of entries to retrieve dam_reset [<password>]
If the TPM is not in a LOCKOUT state, reset the internal error counter.
<password>: optional password
dam_parameters <max_tries> <recovery_time> <lockout_recovery> [<password>]
If the TPM is not in a LOCKOUT state, set the DAM parameters
<maxTries>: maximum number of failures before lockout,
0 means always locking
<recoveryTime>: time before decrement of the error counter,
0 means no lockout
<lockoutRecovery>: time of a lockout (before the next try),
0 means a reboot is needed
<password>: optional password of the LOCKOUT hierarchy change_auth <hierarchy> <new_pw> [<old_pw>]
<hierarchy>: the hierarchy
<new_pw>: new password for <hierarchy>
<old_pw>: optional previous password of <hierarchy> pcr_setauthpolicy|pcr_setauthvalue <pcr> <key> [<password>]
Change the <key> to access PCR #<pcr>.
hierarchy and may be empty.
/!\WARNING: untested function, use at your own risks !
<pcr>: index of the PCR
<key>: secret to protect the access of PCR #<pcr>
<password>: optional password of the PLATFORM hierarchy
Regards,
Stefan
> Thanks,
> Sandeep.
>
> -----Original Message-----
> From: Stefan Berger <stefanb at linux.ibm.com<mailto:stefanb at linux.ibm.com>>
> Sent: Tuesday, May 9, 2023 10:01 PM
> To: Sandeep Kumar <sandeep.pkumar at tcs.com<mailto:sandeep.pkumar at tcs.com>>; Cédric Le Goater
> <clg at kaod.org<mailto:clg at kaod.org>>; openbmc at lists.ozlabs.org<mailto:openbmc at lists.ozlabs.org>; Ninad Palsule
> <ninad at linux.ibm.com<mailto:ninad at linux.ibm.com>>; Joel Stanley <jms at jms.id.au<mailto:jms at jms.id.au>>; Andrew Jeffery
> <andrew at aj.id.au<mailto:andrew at aj.id.au>>
> Subject: Re: Integrating swtpm(as a software TPM) with OpenBMC on Qemu
>
> "External email. Open with Caution"
>
>
> On 5/9/23 08:06, Sandeep Kumar wrote:
>> TCS Confidential
>>
>> Hi Stefan,
>>
>> Thanks for the help.
>>
>> 'MACHINE_FEATURES:append = " tpm2" => this worked for me as well. Could you please also point to the API's which can be used for communicating with swtpm? Any sample code which can be used for reading and writing data to and from the block device ?
>
> TPM 2 has character devices /dev/tpm0 and /dev/tpmrm0 that can for example be used with either one of the tss2 stacks:
>
> meta-security/meta-tpm/recipes-tpm2/ibmtpm2tss
> meta-security/meta-tpm/recipes-tpm2/ibmtpm2tss/ibmtpm2tss
> meta-security/meta-tpm/recipes-tpm2/ibmtpm2tss/ibmtpm2tss/0001-utils-1
> 2-Makefile.am-expand-wildcards-in-prereqs.patch
> meta-security/meta-tpm/recipes-tpm2/ibmtpm2tss/ibmtpm2tss_1661.bb
> meta-security/meta-tpm/recipes-tpm2/tpm2-tss-engine
> meta-security/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.
> 1.0.bb meta-security/meta-tpm/recipes-tpm2/tpm2-tss
> meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss
> meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss/fixup_hosttools.
> patch meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_4.0.1.bb
>
> Intel: https://github.com/tpm2-software/tpm2-tss#overview
> IBM: https://github.com/kgoldman/ibmtss
>
> Stefan
>
>>
>> Thanks,
>> Sandeep.
>>
>> -----Original Message-----
>> From: Stefan Berger <stefanb at linux.ibm.com<mailto:stefanb at linux.ibm.com>>
>> Sent: Saturday, May 6, 2023 2:08 AM
>> To: Sandeep Kumar <sandeep.pkumar at tcs.com<mailto:sandeep.pkumar at tcs.com>>; Cédric Le Goater
>> <clg at kaod.org<mailto:clg at kaod.org>>; openbmc at lists.ozlabs.org<mailto:openbmc at lists.ozlabs.org>; Ninad Palsule
>> <ninad at linux.ibm.com<mailto:ninad at linux.ibm.com>>; Joel Stanley <jms at jms.id.au<mailto:jms at jms.id.au>>; Andrew Jeffery
>> <andrew at aj.id.au<mailto:andrew at aj.id.au>>
>> Subject: Re: Integrating swtpm(as a software TPM) with OpenBMC on
>> Qemu
>>
>> "External email. Open with Caution"
>>
>>
>> On 5/5/23 13:36, Sandeep Kumar wrote:
>>> TCS Confidential
>>>
>>> Hi Stefan,
>>>
>>> I have these options set in
>>> /home/tcs/work/san/openbmc/openbmc_april/openbmc/meta-aspeed/recipes
>>> - k ernel/linux/linux-aspeed/tpm/tpm2.cfg
>>>
>>> CONFIG_HW_RANDOM=y
>>> CONFIG_HW_RANDOM_TPM=y
>>> CONFIG_TCG_TPM=y
>>> CONFIG_TCG_TIS_CORE=y
>>> CONFIG_TCG_TIS=y
>>> CONFIG_TCG_TIS_SPI=y
>>> CONFIG_TCG_TIS_I2C=y
>>> CONFIG_SECURITYFS=y
>>
>>
>> I added 'MACHINE_FEATURES:append = " tpm2"' and this works for me.
>>
>> As long as these symbols are built into the kernel it should work:
>>
>>> root at evb-ast2600:~# grep tpm_tis_i2c /proc/kallsyms 8056318c t
>>> tpm_tis_i2c_remove
>>> 805631b0 t tpm_tis_i2c_retry_transfer_until_ack
>>> 8056323c t tpm_tis_i2c_write_bytes
>>> 80563334 t tpm_tis_i2c_verify_crc
>>> 805633e0 t tpm_tis_i2c_read_bytes
>>> 80563604 t tpm_tis_i2c_probe
>>> 80d23964 t tpm_tis_i2c_driver_init
>>
>>>
>>> and in
>>> /home/tcs/work/san/openbmc/openbmc_april/openbmc/meta-aspeed/recipes
>>> - k ernel/linux/linux-aspeed.inc I have these,
>>>
>>> SRC_URI += " \
>>> file://defconfig \
>>> file://rsa_oem_fitimage_key.key;sha256sum=eeb4ff2ebbfbd97b6254fe6dbaeea41067e54c65176c233ec7b2ab2decf1ddcd \
>>> file://rsa_oem_fitimage_key.crt;sha256sum=45f5a55497cce8040999bf9f3214d471ac7b83ab7acef41c4425a34662e8372e \
>>> ${@bb.utils.contains('MACHINE_FEATURES<mailto:$%7b at bb.utils.contains('MACHINE_FEATURES>', 'tpm2', 'file://tpm/tpm2.scc file://tpm/tpm2.cfg', '', d)} \
>>> ${@bb.utils.contains_any('DISTRO_FEATURES<mailto:$%7b at bb.utils.contains_any('DISTRO_FEATURES>', \
>>> 'obmc-static-norootfs obmc-ubi-fs', \
>>> 'file://ubi/ubi.scc file://ubi/ubi.cfg', '', d)} \
>>> "
>>>
>>> Anything else needs to be done to enable TPM ?
>>
>> Apart from having to use the latest QEMU with the TPM TIS I2C support (from git repo) I don't know of anything else.
>>
>> Stefan
>>
>>>
>>> Thanks,
>>> Sandeep.
>>>
>>> -----Original Message-----
>>> From: Stefan Berger <stefanb at linux.ibm.com<mailto:stefanb at linux.ibm.com>>
>>> Sent: Friday, May 5, 2023 9:41 PM
>>> To: Sandeep Kumar <sandeep.pkumar at tcs.com<mailto:sandeep.pkumar at tcs.com>>; Cédric Le Goater
>>> <clg at kaod.org<mailto:clg at kaod.org>>; openbmc at lists.ozlabs.org<mailto:openbmc at lists.ozlabs.org>; Ninad Palsule
>>> <ninad at linux.ibm.com<mailto:ninad at linux.ibm.com>>; Joel Stanley <jms at jms.id.au<mailto:jms at jms.id.au>>; Andrew Jeffery
>>> <andrew at aj.id.au<mailto:andrew at aj.id.au>>
>>> Subject: Re: Integrating swtpm(as a software TPM) with OpenBMC on
>>> Qemu
>>>
>>> "External email. Open with Caution"
>>>
>>> I enable the following kernel build options for OpenBMC Linux kernel:
>>>
>>> CONFIG_TCG_TPM=y
>>> CONFIG_TCG_TIS_CORE=y
>>> CONFIG_TCG_TIS=y
>>> CONFIG_TCG_TIS_I2C=y
>>>
>>> With swtpm running in another terminal:
>>>
>>> while :; do swtpm socket --tpmstate dir=/tmp/mytpm1 --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock --tpm2 --log level=20; done
>>>
>>> I start qemu built from qemu git master branch tip:
>>>
>>> /tmp/qemu-system-arm -machine ast2600-evb -nographic -no-reboot -net nic -net user,hostfwd=:127.0.0.1:5722-:22,hostfwd=:127.0.0.1:5743-:443,hostfwd=udp:127.0.0.1:5723-:623 -drive file=./tmp/deploy/images/evb-ast2600/obmc-phosphor-image-evb-ast2600.static.mtd,format=raw,if=mtd -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e
>>>
>>> root at evb-ast2600:~# echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device
>>> [ 63.771200] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
>>> [ 63.783927] tpm tpm0: A TPM error (256) occurred attempting the self test
>>> [ 63.784256] tpm tpm0: starting up the TPM manually
>>> [ 63.851474] i2c i2c-12: new_device: Instantiated device tpm_tis_i2c at 0x2e
>>>
>>> root at evb-ast2600:~# uname -a
>>> Linux evb-ast2600 6.1.15-580639a-dirty-c56bfb7-00123-gc56bfb70ebfa
>>> #1 SMP Thu Apr 6 00:55:09 UTC 2023 armv7l GNU/Linux
>>>
>>> root at evb-ast2600:~# grep tpm_tis_i2c /proc/kallsyms> 8056318c t
>>> tpm_tis_i2c_remove
>>> 805631b0 t tpm_tis_i2c_retry_transfer_until_ack
>>> 8056323c t tpm_tis_i2c_write_bytes
>>> 80563334 t tpm_tis_i2c_verify_crc
>>> 805633e0 t tpm_tis_i2c_read_bytes
>>> 80563604 t tpm_tis_i2c_probe
>>> 80d23964 t tpm_tis_i2c_driver_init
>>>
>>> root at evb-ast2600:~# find /sys/class/tpm /sys/class/tpm
>>> /sys/class/tpm/tpm0
>>>
>>> root at evb-ast2600:~# ls -l /dev/tpm*
>>> crw------- 1 root root 10, 224 May 5 16:03 /dev/tpm0
>>> crw------- 1 root root 252, 65536 May 5 16:03 /dev/tpmrm0
>>>
>>> root at evb-ast2600:~# find /sys/ | grep pcr
>>> /sys/devices/platform/ahb/ahb:apb/ahb:apb:bus at 1e78a000/1e78a680.i2c-
>>> b
>>> u
>>> s/i2c-12/12-002e/tpm/tpm0/pcr-sha1
>>> /sys/devices/platform/ahb/ahb:apb/ahb:apb:bus at 1e78a000/1e78a680.i2c-
>>> b
>>> u
>>> s/i2c-12/12-002e/tpm/tpm0/pcr-sha1/17
>>> [... lots more entries also for sha256, sha384, and sha512 ]
>>>
>>>
>>>
>>>
>>> It seems to work as expected
>>>
>>> On 5/5/23 11:08, Sandeep Kumar wrote:
>>>> TCS Confidential Hi Stefan, Please find below my answers inline.
>>>> Thanks, Sandeep. -----Original Message----- From: Stefan Berger
>>>> <stefanb@ linux. ibm. com> Sent: Friday, May 5, 2023 6: 56 PM To:
>>>> Sandeep Kumar <sandeep. pkumar@ tcs. com>; ZjQcmQRYFpfptBannerStart This Message Is From an External Sender This message came from outside your organization.
>>>> ZjQcmQRYFpfptBannerEnd
>>>>
>>>> TCS Confidential
>>>>
>>>>
>>>> Hi Stefan,
>>>>
>>>> Please find below my answers inline.
>>>>
>>>> Thanks,
>>>>
>>>> Sandeep.
>>>>
>>>> -----Original Message-----
>>>> From: Stefan Berger <stefanb at linux.ibm.com<mailto:stefanb at linux.ibm.com>>
>>>> Sent: Friday, May 5, 2023 6:56 PM
>>>> To: Sandeep Kumar <sandeep.pkumar at tcs.com<mailto:sandeep.pkumar at tcs.com>>; Cédric Le Goater
>>>> <clg at kaod.org<mailto:clg at kaod.org>>; openbmc at lists.ozlabs.org<mailto:openbmc at lists.ozlabs.org>; Ninad Palsule
>>>> <ninad at linux.ibm.com<mailto:ninad at linux.ibm.com>>; Joel Stanley <jms at jms.id.au<mailto:jms at jms.id.au>>; Andrew Jeffery
>>>> <andrew at aj.id.au<mailto:andrew at aj.id.au>>
>>>> Subject: Re: Integrating swtpm(as a software TPM) with OpenBMC on
>>>> Qemu
>>>>
>>>> "External email. Open with Caution"
>>>>
>>>> On 5/5/23 01:40, Sandeep Kumar wrote:
>>>>
>>>> > TCS Confidential
>>>>
>>>> >
>>>>
>>>> > Hi Stefan,
>>>>
>>>> >
>>>>
>>>> > Stefan: Is the kernel configured in the same way? Are you using the same kernel version?
>>>>
>>>> > Ans:
>>>>
>>>> > I am using the Kernel version coming with the latest openBMC without any changes.
>>>>
>>>> > Kernel version used : Linux evb-ast2600 6.1.15-580639a #1
>>>> SMP
>>>>
>>>> > Thu Apr 6 00:55:09 UTC 2023 armv71 GNU/Linux
>>>>
>>>> >
>>>>
>>>> > Stefan: What is the output of this? find /sys/class/tpm |
>>>> grep pcr
>>>>
>>>> > Ams: find: /sys/class/tpm: No such file or directory.
>>>>
>>>> >
>>>>
>>>> > Could you please point to the right version of kernel which has all these changes ?
>>>>
>>>> I am not aware of changes in the Linux kernel for TPM I2C and why it would not work in this kernel version.
>>>>
>>>> Does this show any files?
>>>>
>>>> find /sys | grep pcr
>>>>
>>>> *Sandeep: It doesn't show any files. *
>>>>
>>>> *root at evb-ast2600:~# echo tpm_tis_i2c 0x2e >
>>>> /sys/bus/i2c/devices/i2c-12/new_device*
>>>>
>>>> *[ 273.273089] i2c i2c-12: new_device: Instantiated device
>>>> tpm_tis_i2c at 0x2e*
>>>>
>>>> *root at evb-ast2600:~#*
>>>>
>>>> *root at evb-ast2600:~# find /sys | grep pcr*
>>>>
>>>> *root at evb-ast2600:~#*
>>>>
>>>> Do /dev/tpm0 and /dev/tpmrm0 appear after the echo ? What does dmesg show related to tpm (dmesg | grep -i tpm)?
>>>>
>>>> *Sandeep: I don’t see /dev/tpm0 and /dev/tpmrm0 after the echo.
>>>> Output as below, *
>>>>
>>>> **
>>>>
>>>> *root at evb-ast2600:~# echo tpm_tis_i2c 0x2e >
>>>> /sys/bus/i2c/devices/i2c-12/new_device*
>>>>
>>>> *[ 273.273089] i2c i2c-12: new_device: Instantiated device
>>>> tpm_tis_i2c at 0x2e*
>>>>
>>>> *root at evb-ast2600:~#*
>>>>
>>>> *root at evb-ast2600:~# find /sys | grep pcr*
>>>>
>>>> *root at evb-ast2600:~#*
>>>>
>>>> *root at evb-ast2600:~# ls /dev/tpm**
>>>>
>>>> *ls: /dev/tpm*: No such file or directory*
>>>>
>>>> *root at evb-ast2600:~# dmesg | grep -i tpm*
>>>>
>>>> *[ 6.290898] systemd[1]: systemd 253.1^ running in system mode
>>>> (+PAM -AUDIT -SELINUX -APPARMOR -IMA -SMACK +SECCOMP -GCRYPT
>>>> -GNUTLS -OPENSSL -ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN
>>>> -IPTC -KMOD -LIBCRYPTSETUP +LIBFDISK -PCRE2 -PWQUALITY -P11KIT
>>>> -QRENCODE -TPM2
>>>> -BZIP2 -LZ4 -XZ -ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON -UTMP
>>>> -SYSVINIT
>>>> default-hierarchy=unified)*
>>>>
>>>> *[ 273.273089] i2c i2c-12: new_device: Instantiated device
>>>> tpm_tis_i2c at 0x2e*
>>>>
>>>> *root at evb-ast2600:~#*
>>>>
>>>> Stefan
>>>>
>>>> >
>>>>
>>>> >
>>>>
>>>> > Thanks,
>>>>
>>>> > Sandeep.
>>>>
>>>> >
>>>>
>>>> > -----Original Message-----
>>>>
>>>> > From: Stefan Berger <stefanb at linux.ibm.com
>>>> <mailto:stefanb at linux.ibm.com>>
>>>>
>>>> > Sent: Thursday, May 4, 2023 7:30 PM
>>>>
>>>> > To: Sandeep Kumar <sandeep.pkumar at tcs.com
>>>> <mailto:sandeep.pkumar at tcs.com>>; Cédric Le Goater
>>>>
>>>> > <clg at kaod.org <mailto:clg at kaod.org<mailto:clg at kaod.org%20%3cmailto:clg at kaod.org>>>;
>>>> openbmc at lists.ozlabs.org<mailto:openbmc at lists.ozlabs.org> <mailto:openbmc at lists.ozlabs.org>; Ninad
>>>> Palsule
>>>>
>>>> > <ninad at linux.ibm.com <mailto:ninad at linux.ibm.com<mailto:ninad at linux.ibm.com%20%3cmailto:ninad at linux.ibm.com>>>; Joel
>>>> Stanley <jms at jms.id.au <mailto:jms at jms.id.au<mailto:jms at jms.id.au%20%3cmailto:jms at jms.id.au>>>; Andrew Jeffery
>>>>
>>>> > <andrew at aj.id.au <mailto:andrew at aj.id.au<mailto:andrew at aj.id.au%20%3cmailto:andrew at aj.id.au>>>
>>>>
>>>> > Subject: Re: Integrating swtpm(as a software TPM) with
>>>> OpenBMC on Qemu
>>>>
>>>> >
>>>>
>>>> > "External email. Open with Caution"
>>>>
>>>> >
>>>>
>>>> >
>>>>
>>>> > On 5/4/23 05:12, Sandeep Kumar wrote:
>>>>
>>>> >> TCS Confidential Hi C, I was able to build and run the
>>>> image(for
>>>>
>>>> >> evb-ast2600) with swtpm. Few issues observed, If I run with
>>>> the
>>>>
>>>> >> flash. img provided in your github link(https: //github.
>>>>
>>>> >> com/legoater/qemu-aspeed-boot/tree/master/images) everything ZjQcmQRYFpfptBannerStart This Message Is From an External Sender This message came from outside your organization.
>>>>
>>>> >> ZjQcmQRYFpfptBannerEnd
>>>>
>>>> >> TCS Confidential
>>>>
>>>> >>
>>>>
>>>> >> Hi C,
>>>>
>>>> >> I was able to build and run the image(for evb-ast2600) with swtpm.
>>>>
>>>> >> Few issues observed,
>>>>
>>>> >>
>>>>
>>>> >> 1. If I run with the flash.img provided in your github link(_https://github.com/legoater/qemu-aspeed-boot/tree/master/images_ <https://github.com/legoater/qemu-aspeed-boot/tree/master/images <https://github.com/legoater/qemu-aspeed-boot/tree/master/images<https://github.com/legoater/qemu-aspeed-boot/tree/master/images%20%3chttps:/github.com/legoater/qemu-aspeed-boot/tree/master/images>>>) everything works as expected, i.e I get the below output.
>>>>
>>>> >>
>>>>
>>>> >> *# echo tpm_tis_i2c 0x2e >
>>>> /sys/bus/i2c/devices/i2c-12/new_device*
>>>>
>>>> >> *[ 182.735902] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1,
>>>> rev-id
>>>>
>>>> >> 1)* *[ 182.773885] i2c i2c-12: new_device: Instantiated
>>>> device
>>>>
>>>> >> tpm_tis_i2c at 0x2e*
>>>>
>>>> >> *#*
>>>>
>>>> >> *#*
>>>>
>>>> >> *# cat /sys/class/tpm/tpm0/pcr-sha256/0*
>>>>
>>>> >>
>>>> *B804724EA13F52A9072BA87FE8FDCC497DFC9DF9AA15B9088694639C431688E0*
>>>>
>>>> >> *#*
>>>>
>>>> >> *#*
>>>>
>>>> >>
>>>>
>>>> >> 2. If I run it with the locally built image, I get this error,
>>>>
>>>> >
>>>>
>>>> > Is the kernel configured in the same way? Are you using the same kernel version?
>>>>
>>>> >>
>>>>
>>>> >> *root at evb-ast2600:~# echo tpm_tis_i2c 0x2e >
>>>>
>>>> >> /sys/bus/i2c/devices/i2c-12/new_device*
>>>>
>>>> >> *[ 174.063597] i2c i2c-12: new_device: Instantiated device
>>>>
>>>> >> tpm_tis_i2c at 0x2e*
>>>>
>>>> >
>>>>
>>>> > What is the output of this?
>>>>
>>>> >
>>>>
>>>> > find /sys/class/tpm | grep pcr
>>>>
>>>> >
>>>>
>>>> > Stefan
>>>>
>>>> >
>>>>
>>>> >> *root at evb-ast2600:~# cat /sys/class/tpm/tpm0/pcr-sha256/0*
>>>>
>>>> >> *cat: can't open '/sys/class/tpm/tpm0/pcr-sha256/0': No such
>>>> file or
>>>>
>>>> >> directory*
>>>>
>>>> >> *root at evb-ast2600:~#*
>>>>
>>>> >> *root at evb-ast2600:~#*
>>>>
>>>> >> Please do let me know about what has been done to write the
>>>> values
>>>>
>>>> >> into “*/sys/class/tpm/tpm0/pcr-sha256/0**” . * Thanks, Sandeep.
>>>>
>>>> >> _____________________________________________
>>>>
>>>> >> *From:* Sandeep Kumar
>>>>
>>>> >> *Sent:* Thursday, April 20, 2023 5:45 PM
>>>>
>>>> >> *To:* Cédric Le Goater <clg at kaod.org <mailto:clg at kaod.org<mailto:clg at kaod.org%20%3cmailto:clg at kaod.org>>>;
>>>> openbmc at lists.ozlabs.org<mailto:openbmc at lists.ozlabs.org> <mailto:openbmc at lists.ozlabs.org>;
>>>>
>>>> >> Ninad Palsule <ninad at linux.ibm.com
>>>> <mailto:ninad at linux.ibm.com>>; Joel Stanley <jms at jms.id.au
>>>> <mailto:jms at jms.id.au>>;
>>>>
>>>> >> Andrew Jeffery <andrew at aj.id.au <mailto:andrew at aj.id.au<mailto:andrew at aj.id.au%20%3cmailto:andrew at aj.id.au>>>
>>>>
>>>> >> *Subject:* RE: Integrating swtpm(as a software TPM) with
>>>> OpenBMC on
>>>>
>>>> >> Qemu Hi C, How to build this image =>
>>>>
>>>> >> *obmc-phosphor-image.rootfs.wic.qcow2* ? In openBmc build directory we don’t get this image built.
>>>>
>>>> >> Also, remaining image formats used while running on qemu are available in the build directory. i.e fitImage-linux.bin, aspeed-bmc-ibm-rainier.dtb and obmc-phosphor-initramfs.rootfs.cpio.xz .
>>>>
>>>> >> Please advise if we have to build openbmc stack in a
>>>> different way
>>>>
>>>> >> than the standard procedure. We follow the below steps for build, 1. .
>>>>
>>>> >> setup Romulus 2. bitbake obmc-phosphor-image Thanks, Sandeep.
>>>>
>>>> >> -----Original Message-----
>>>>
>>>> >> From: Sandeep Kumar
>>>>
>>>> >> Sent: Wednesday, April 19, 2023 3:00 PM
>>>>
>>>> >> To: Cédric Le Goater <_clg at kaod.org_ <mailto:clg at kaod.org
>>>> <mailto:_clg at kaod.org_%20%3cmailto:clg at kaod.org>>>;
>>>>
>>>> >> _openbmc at lists.ozlabs.org_<mailto:_openbmc at lists.ozlabs.org_>
>>>> <mailto:_openbmc at lists.ozlabs.org_>
>>>> <mailto:openbmc at lists.ozlabs.org
>>>> <mailto:openbmc at lists.ozlabs.org>>;
>>>> Ninad
>>>>
>>>> >> Palsule <_ninad at linux.ibm.com_ <mailto:ninad at linux.ibm.com
>>>> <mailto:_ninad at linux.ibm.com_%20%3cmailto:ninad at linux.ibm.com>>>;
>>>> Joel
>>>>
>>>> >> Stanley <_jms at jms.id.au_ <mailto:jms at jms.id.au
>>>> <mailto:_jms at jms.id.au_%20%3cmailto:jms at jms.id.au>>>; Andrew
>>>> Jeffery
>>>>
>>>> >> <_andrew at aj.id.au_ <mailto:andrew at aj.id.au
>>>> <mailto:_andrew at aj.id.au_%20%3cmailto:andrew at aj.id.au>>>
>>>>
>>>> >> Subject: RE: Integrating swtpm(as a software TPM) with
>>>> OpenBMC on
>>>>
>>>> >> Qemu Hi C, Got it working. Looks like slirp is no longer
>>>> supported on
>>>>
>>>> >> ubnutu 18.04. have upgraded to a newer version and is working now.
>>>>
>>>> >> Thanks,
>>>>
>>>> >> Sandeep.
>>>>
>>>> >> -----Original Message-----
>>>>
>>>> >> From: Cédric Le Goater <clg at kaod.org <mailto:clg at kaod.org
>>>> <mailto:clg at kaod.org%20%3cmailto:clg at kaod.org>>>
>>>>
>>>> >> Sent: Wednesday, April 19, 2023 2:26 PM
>>>>
>>>> >> To: Sandeep Kumar <sandeep.pkumar at tcs.com
>>>>
>>>> >> <mailto:sandeep.pkumar at tcs.com
>>>> <mailto:sandeep.pkumar at tcs.com>>>;
>>>> openbmc at lists.ozlabs.org<mailto:openbmc at lists.ozlabs.org> <mailto:openbmc at lists.ozlabs.org>
>>>>
>>>> >> <mailto:openbmc at lists.ozlabs.org
>>>> <mailto:openbmc at lists.ozlabs.org>>; Ninad Palsule
>>>> <ninad at linux.ibm.com
>>>>
>>>> >> <mailto:ninad at linux.ibm.com <mailto:ninad at linux.ibm.com<mailto:ninad at linux.ibm.com%20%3cmailto:ninad at linux.ibm.com>>>>;
>>>> Joel Stanley <jms at jms.id.au
>>>>
>>>> >> <mailto:jms at jms.id.au <mailto:jms at jms.id.au<mailto:jms at jms.id.au%20%3cmailto:jms at jms.id.au>>>>; Andrew
>>>> Jeffery <andrew at aj.id.au
>>>>
>>>> >> <mailto:andrew at aj.id.au <mailto:andrew at aj.id.au<mailto:andrew at aj.id.au%20%3cmailto:andrew at aj.id.au>>>>
>>>>
>>>> >> Subject: Re: Integrating swtpm(as a software TPM) with
>>>> OpenBMC on
>>>>
>>>> >> Qemu "External email. Open with Caution"
>>>>
>>>> >> Hello Sandeep
>>>>
>>>> >> On 4/18/23 09:45, Sandeep Kumar wrote:
>>>>
>>>> >>> TCS Confidential
>>>>
>>>> >>>
>>>>
>>>> >>> Hi C,
>>>>
>>>> >>> Built the qemu from your branch. Few issues, *$
>>>> ./qemu-system-arm -m
>>>>
>>>> >>> 256 -M romulus-bmc -nographic -drive
>>>>
>>>> >>>
>>>> file=./obmc-phosphor-image-romulus.static.mtd,format=raw,if=mtd
>>>> -net
>>>>
>>>> >>> nic -net
>>>>
>>>> >>>
>>>> user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:4443-:443,hostf
>>>> w
>>>>
>>>> >>> d
>>>>
>>>> >>> =
>>>>
>>>> >>> tcp:127.0.0.1:8880-:80,hostfwd=tcp:127.0.0.1:2200-:2200,hostfwd=udp:
>>>>
>>>> >>> 1
>>>>
>>>> >>> 2
>>>>
>>>> >>>
>>>> 7.0.0.1:6623-:623,hostfwd=udp:127.0.0.1:6664-:664,hostname=qemu*
>>>>
>>>> >>> *qemu-system-arm: -net
>>>>
>>>> >>>
>>>> user,hostfwd=:127.0.0.1:2222-:22,hostfwd=:127.0.0.1:4443-:443,hostf
>>>> w
>>>>
>>>> >>> d
>>>>
>>>> >>> =
>>>>
>>>> >>> tcp:127.0.0.1:8880-:80,hostfwd=tcp:127.0.0.1:2200-:2200,hostfwd=udp:
>>>>
>>>> >>> 1
>>>>
>>>> >>> 2
>>>>
>>>> >>> 7.0.0.1:6623-:623,hostfwd=udp:127.0.0.1:6664-:664,hostname=qemu:
>>>>
>>>> >>> network backend 'user' is not compiled into this binary* I
>>>> didn’t
>>>>
>>>> >>> enable the slirp package I guess. So enabled it while
>>>> running
>>>>
>>>> >>> configure, *$ ../configure --enable-slirp*
>>>>
>>>> >>> *........*
>>>>
>>>> >>> *Run-time dependency slirp found: NO (tried pkgconfig)*
>>>>
>>>> >>> *../meson.build:681:2: ERROR: Dependency "slirp" not found,
>>>> tried
>>>>
>>>> >>> pkgconfig* *A full log can be found at
>>>>
>>>> >>>
>>>> /home/tcs/work/sandeep/measured_boot/ibm_qemu/qemu/build/meson-logs
>>>> /
>>>>
>>>> >>> m
>>>>
>>>> >>> e
>>>>
>>>> >>> son-log.txt*
>>>>
>>>> >>> *NOTICE: You are using Python 3.6 which is EOL. Starting
>>>> with
>>>>
>>>> >>> v0.62.0, Meson will require Python 3.7 or newer*
>>>>
>>>> >>> *ERROR: meson setup failed*
>>>>
>>>> >>> I have already installed slirp locally, but still getting the above error.
>>>>
>>>> >> Did you install the libslirp-dev or libslirp-devel package ?
>>>>
>>>> >> C.
>>>>
>>>> >>
>>>>
>>>> >> TCS Confidential
>>>>
>>>> >>
>>>>
>>>> >> =====-----=====-----=====
>>>>
>>>> >> Notice: The information contained in this e-mail message
>>>> and/or
>>>>
>>>> >> attachments to it may contain confidential or privileged information.
>>>>
>>>> >> If you are not the intended recipient, any dissemination,
>>>> use,
>>>>
>>>> >> review, distribution, printing or copying of the information
>>>>
>>>> >> contained in this e-mail message and/or attachments to it
>>>> are
>>>>
>>>> >> strictly prohibited. If you have received this communication
>>>> in
>>>>
>>>> >> error, please notify us by reply e-mail or telephone and
>>>> immediately
>>>>
>>>> >> and permanently delete the message and any attachments.
>>>> Thank you
>>>>
>>>> >>
>>>>
>>>> >
>>>>
>>>> > TCS Confidential
>>>>
>>>>
>>>> TCS Confidential
>>>>
>>>
>>> TCS Confidential
>>
>> TCS Confidential
>
> TCS Confidential
TCS Confidential
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20230523/8af7ac7a/attachment-0001.htm>
More information about the openbmc
mailing list