Skip to content

Commit f7e0e99

Browse files
dgarskedgarske
committed
Add documentation for using ms-tpm-20-ref TPM simulator. Move the "QEMU and swtpm" into docs/SWTPM.md.
1 parent 1fa1595 commit f7e0e99

2 files changed

Lines changed: 152 additions & 109 deletions

File tree

‎README.md‎

Lines changed: 0 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -244,91 +244,6 @@ Note: When using a TPM device through the Linux kernel driver make sure sufficie
244244
sudo adduser yourusername tss
245245
```
246246

247-
#### With QEMU and swtpm
248-
249-
This demonstrates using wolfTPM in QEMU to communicate using the linux
250-
kernel device "/dev/tpmX". You will need to install or build
251-
[swtpm](https://github.com/stefanberger/swtpm). Below are a short
252-
method to build. You may need to consult the instructions for
253-
[libtpms](https://github.com/stefanberger/libtpms/wiki#compile-and-install-on-linux)
254-
and
255-
[swtpm](https://github.com/stefanberger/swtpm/wiki#compile-and-install-on-linux)
256-
257-
```
258-
PREFIX=$PWD/inst
259-
git clone git@github.com:stefanberger/libtpms.git
260-
cd libtpms/
261-
./autogen.sh --with-openssl --with-tpm2 --prefix=$PREFIX && make install
262-
cd ..
263-
git clone git@github.com:stefanberger/swtpm.git
264-
cd swtpm
265-
PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig/ ./autogen.sh --with-openssl --with-tpm2 \
266-
--prefix=$PREFIX && \
267-
make install
268-
cd ..
269-
```
270-
271-
You can setup a basic linux installation. Other installation bases can
272-
be used. This step will take some time to install the base linux
273-
system.
274-
275-
```
276-
# download mini install image
277-
curl -O http://archive.ubuntu.com/ubuntu/dists/bionic-updates/main/installer-amd64/current/images/netboot/mini.iso
278-
# create qemu image file
279-
qemu-img create -f qcow2 lubuntu.qcow2 5G
280-
# create directory for tpm state and socket
281-
mkdir $PREFIX/mytpm
282-
# start swtpm
283-
$PREFIX/bin/swtpm socket --tpm2 --tpmstate dir=$PREFIX/mytpm \
284-
--ctrl type=unixio,path=$PREFIX/mytpm/swtpm-sock --log level=20 &
285-
# start qemu for installation
286-
qemu-system-x86_64 -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
287-
-chardev socket,id=chrtpm,path=$PREFIX/mytpm/swtpm-sock \
288-
-tpmdev emulator,id=tpm0,chardev=chrtpm \
289-
-device tpm-tis,tpmdev=tpm0 -hda lubuntu.qcow2 -cdrom mini.iso
290-
```
291-
292-
Once a base system is installed it's ready to start the qemu and build
293-
wolfSSL and wolfTPM in the qemu instance.
294-
295-
```
296-
# start swtpm again
297-
$PREFIX/bin/swtpm socket --tpm2 --tpmstate dir=$PREFIX/mytpm \
298-
--ctrl type=unixio,path=$PREFIX/mytpm/swtpm-sock --log level=20 &
299-
# start qemu system to install and run wolfTPM
300-
qemu-system-x86_64 -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
301-
-chardev socket,id=chrtpm,path=$PREFIX/mytpm/swtpm-sock \
302-
-tpmdev emulator,id=tpm0,chardev=chrtpm \
303-
-device tpm-tis,tpmdev=tpm0 -hda lubuntu.qcow2
304-
```
305-
306-
To build checkout and build wolfTPM, in the QEMU terminal
307-
308-
```
309-
sudo apt install automake libtool gcc git make
310-
311-
# get and build wolfSSL
312-
git clone https://github.com/wolfssl/wolfssl.git
313-
pushd wolfssl
314-
./autogen.sh && \
315-
./configure --enable-wolftpm --disable-examples --prefix=$PWD/../inst && \
316-
make install
317-
popd
318-
319-
# get and build wolfTPM
320-
git clone https://github.com/wolfssl/wolftpm.git
321-
pushd wolftpm
322-
./autogen.sh && \
323-
./configure --enable-devtpm --prefix=$PWD/../inst --enable-debug && \
324-
make install
325-
sudo make check
326-
popd
327-
```
328-
329-
You can now run the examples such as `sudo ./examples/wrap/wrap`
330-
within QEMU. Using `sudo` maybe required for access to `/dev/tpm0`.
331-
332247
### Building for SWTPM
333248

334249
See `docs/SWTPM.md`

‎docs/SWTPM.md‎

Lines changed: 152 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,107 @@
1-
# Using wolfTPM with SWTPM
1+
# wolfTPM with Software Simulator (SWTPM) support
22

3-
wolfTPM is to be able to interface with SW TPM interfaces defined by
4-
section D.3 of
5-
[TPM-Rev-2.0-Part-4-Supporting-Routines-01.38-code](https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-4-Supporting-Routines-01.38-code.pdf)
3+
wolfTPM is to be able to interface with software TPM (SW TPM) interfaces defined by section D.3 of [TPM-Rev-2.0-Part-4-Supporting-Routines-01.38-code](https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-4-Supporting-Routines-01.38-code.pdf)
64

7-
Using the socket connection for SWTPM is exclusive and not compatible
8-
with TIS or devtpm.
5+
The SWTPM interface is not compatible with TIS or devtpm (/dev/tpm0). Transport is a socket connection by default, but can also be a UART.
96

10-
Only a subset of functionality is implemented to support testing of
11-
wolfTPM. The platform requests are not used by wolfTPM.
7+
This implementation only uses the TPM command interface typically on port 2321. It does not support the Platform interface typically on port 2322.
128

13-
Two implementations were used in testing:
14-
15-
* https://sourceforge.net/projects/ibmswtpm2/files/
9+
Software TPM implementations tested:
10+
* https://github.com/kgoldman/ibmswtpm2 or https://sourceforge.net/projects/ibmswtpm2/files/
11+
* https://github.com/microsoft/ms-tpm-20-ref
1612
* https://github.com/stefanberger/swtpm
1713

18-
## Building with SW TPM support
14+
## Building SW TPM support
1915

20-
```
16+
By default a socket transport will be used.
17+
18+
```sh
2119
./configure --enable-swtpm
2220
make
2321
```
2422

23+
### Build SW TPM with UART transport
24+
25+
```sh
26+
./configure --enable-swtpm=uart
27+
make
28+
```
29+
30+
## Build Options
31+
32+
* `WOLFTPM_SWTPM`: Use socket transport (no TIS layer)
33+
* `TPM2_SWTPM_HOST`: The serial device to use (default=/dev/ttyS0)
34+
* `TPM2_SWTPM_PORT`: The baud rate (default=115200)
35+
* `WOLFTPM_SWTPM_UART`: Use UART transport (no TIS layer)
36+
2537
## SWTPM simulator setup
2638

39+
### Xilinx UART
40+
41+
Alternatively for raw API calls with Xilinx
42+
43+
```sh
44+
./cofnigure --enable-swtpm=uartns550
45+
make
46+
```
47+
48+
## Build Options
49+
50+
* `WOLFTPM_SWTPM`: Use socket transport (no TIS layer)
51+
* `TPM2_SWTPM_PORT`: Used as the default baud rate (default=115200)
52+
* `TPM2_SWTPM_HOST`: The device to connect with (default=XPAR_MB0_AXI_UART16550_2_DEVICE_ID)
53+
* `WOLFTPM_SWTPM_UARTNS550`: Use Xilinx UART transport (no TIS layer)
54+
2755
### ibmswtpm2
2856

2957
Checkout and Build
30-
```
58+
```sh
3159
git clone https://github.com/kgoldman/ibmswtpm2.git
3260
cd ibmswtpm2/src/
3361
make
3462
```
3563

3664
Running:
37-
```
65+
```sh
3866
./tpm_server -rm
3967
```
4068

41-
The rm switch is optional and remove the cache file
42-
NVChip. Alternately you can `rm NVChip`
69+
The rm switch is optional and remove the cache file NVChip. Alternately you can `rm NVChip`
70+
71+
### ms-tpm-20-ref
72+
73+
```sh
74+
git clone https://github.com/microsoft/ms-tpm-20-ref
75+
cd ms-tpm-20-ref
76+
./bootstrap
77+
./configure
78+
make
79+
./Simulator/src/tpm2-simulator
80+
```
4381

4482
### swtpm
4583

4684
Build libtpms
4785

48-
```
86+
```sh
4987
git clone git@github.com:stefanberger/libtpms.git
50-
(cd libtpms && ./autogen.sh --with-tpm2 --with-openssl --prefix=/usr && make install)
88+
cd libtpms
89+
./autogen.sh --with-tpm2 --with-openssl --prefix=/usr
90+
make install
5191
```
5292

5393
Build swtpm
5494

55-
```
95+
```sh
5696
git clone git@github.com:stefanberger/swtpm.git
57-
(cd swtpm && ./autogen.sh && make install)
97+
cd swtpm
98+
./autogen.sh
99+
make install
58100
```
59101

60102
Note: On Mac OS X had to do the following first:
61103

62-
```
104+
```sh
63105
brew install openssl socat
64106
pip3 install cryptography
65107

@@ -71,16 +113,102 @@ export CPPFLAGS="-I/usr/local/opt/openssl@1.1/include"
71113

72114
Running swtpm
73115

74-
```
116+
```sh
75117
mkdir -p /tmp/myvtpm
76118
swtpm socket --tpmstate dir=/tmp/myvtpm --tpm2 --ctrl type=tcp,port=2322 --server type=tcp,port=2321 --flags not-need-init
77119
```
78120

79121
## Running examples
80122

81-
```
123+
```sh
82124
./examples/pcr/extend
83125
./examples/wrap/wrap_test
84126
```
85127

86128
See `README.md` for more examples
129+
130+
131+
### swtpm with QEMU
132+
133+
This demonstrates using wolfTPM in QEMU to communicate using the linux
134+
kernel device "/dev/tpmX". You will need to install or build
135+
[swtpm](https://github.com/stefanberger/swtpm). Below are a short
136+
method to build. You may need to consult the instructions for
137+
[libtpms](https://github.com/stefanberger/libtpms/wiki#compile-and-install-on-linux)
138+
and
139+
[swtpm](https://github.com/stefanberger/swtpm/wiki#compile-and-install-on-linux)
140+
141+
```
142+
PREFIX=$PWD/inst
143+
git clone git@github.com:stefanberger/libtpms.git
144+
cd libtpms/
145+
./autogen.sh --with-openssl --with-tpm2 --prefix=$PREFIX && make install
146+
cd ..
147+
git clone git@github.com:stefanberger/swtpm.git
148+
cd swtpm
149+
PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig/ ./autogen.sh --with-openssl --with-tpm2 \
150+
--prefix=$PREFIX && \
151+
make install
152+
cd ..
153+
```
154+
155+
You can setup a basic linux installation. Other installation bases can
156+
be used. This step will take some time to install the base linux
157+
system.
158+
159+
```
160+
# download mini install image
161+
curl -O http://archive.ubuntu.com/ubuntu/dists/bionic-updates/main/installer-amd64/current/images/netboot/mini.iso
162+
# create qemu image file
163+
qemu-img create -f qcow2 lubuntu.qcow2 5G
164+
# create directory for tpm state and socket
165+
mkdir $PREFIX/mytpm
166+
# start swtpm
167+
$PREFIX/bin/swtpm socket --tpm2 --tpmstate dir=$PREFIX/mytpm \
168+
--ctrl type=unixio,path=$PREFIX/mytpm/swtpm-sock --log level=20 &
169+
# start qemu for installation
170+
qemu-system-x86_64 -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
171+
-chardev socket,id=chrtpm,path=$PREFIX/mytpm/swtpm-sock \
172+
-tpmdev emulator,id=tpm0,chardev=chrtpm \
173+
-device tpm-tis,tpmdev=tpm0 -hda lubuntu.qcow2 -cdrom mini.iso
174+
```
175+
176+
Once a base system is installed it's ready to start the qemu and build
177+
wolfSSL and wolfTPM in the qemu instance.
178+
179+
```
180+
# start swtpm again
181+
$PREFIX/bin/swtpm socket --tpm2 --tpmstate dir=$PREFIX/mytpm \
182+
--ctrl type=unixio,path=$PREFIX/mytpm/swtpm-sock --log level=20 &
183+
# start qemu system to install and run wolfTPM
184+
qemu-system-x86_64 -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
185+
-chardev socket,id=chrtpm,path=$PREFIX/mytpm/swtpm-sock \
186+
-tpmdev emulator,id=tpm0,chardev=chrtpm \
187+
-device tpm-tis,tpmdev=tpm0 -hda lubuntu.qcow2
188+
```
189+
190+
To build checkout and build wolfTPM, in the QEMU terminal
191+
192+
```
193+
sudo apt install automake libtool gcc git make
194+
195+
# get and build wolfSSL
196+
git clone https://github.com/wolfssl/wolfssl.git
197+
pushd wolfssl
198+
./autogen.sh && \
199+
./configure --enable-wolftpm --disable-examples --prefix=$PWD/../inst && \
200+
make install
201+
popd
202+
203+
# get and build wolfTPM
204+
git clone https://github.com/wolfssl/wolftpm.git
205+
pushd wolftpm
206+
./autogen.sh && \
207+
./configure --enable-devtpm --prefix=$PWD/../inst --enable-debug && \
208+
make install
209+
sudo make check
210+
popd
211+
```
212+
213+
You can now run the examples such as `sudo ./examples/wrap/wrap`
214+
within QEMU. Using `sudo` maybe required for access to `/dev/tpm0`.

0 commit comments

Comments
 (0)