The following set of patches add TPM and Trusted Computing support to SeaBIOS. In particular the patches add:
- a TPM driver for the Qemu's TPM TIS emulation (not yet in Qemu git) - ACPI support for the TPM device (SSDT table) - ACPI support for measurement logging (TCPA table) - Support for initialzation of the TPM - Support for the TCG BIOS extensions (1ah handler [ah = 0xbb]) (used by trusted grub; http://trousers.sourceforge.net/grub.html) - Static Root of Trusted for Measurement (SRTM) support - Support for S3 resume (sends command to TPM upon resume) - TPM-specific menu for controlling aspects of the TPM - [An optional test suite for the TIS interface]
All implementations necessarily follow specifications.
When all patches are applied the following services are available - SSDT ACPI table for TPM support - initialization of the TPM upon VM start and S3 resume - Static root of trust for measurements (SRTM) that measures (some) data of SeaBIOS in TCPA ACPI table - 1ah interrupt handler offering APIs for measuring and sending commands to the TPM (trusted grub uses them) - User menu for controlling aspects of the state of the TPM
v7: - adapted patches to checkout of 83012de (Aug 31) - fixed compilation error reported by Andreas Niederl
v6: - adapted patches to checkout of 8e30147 (Aug 9) - use timeouts/durations for commands as reported by TPM - following Andreas Niederl's suggestion regarding the ACPI SSDT
v5: - adapted patches to checkout of 76b5e71 (June 21) - bugfixes (see individual patches) - added patch to support the transfer of Qemu-provided measurements via firmware interface
v4: - if ! has_working_tpm() now returns error code everywhere - tis_test.c now also under LGPLv3 - in inthandler, pulled set_cf() out of switch and then only call it in the default case where we need to indicate that a function is not implemented
v3: - some nits here and there - calling timer_setup now after S3 resume
v2: - following Kevin's comment - refactoring code so that every patch compiles
Regards, Stefan