Bug 11466

Summary:	TPM 2.0 support (under qemu)
Product:	[Yocto Project Subprojects] IoT Reference OS Kit	Reporter:	Patrick Ohly <patrick.ohly>
Component:	intel-iot-refkit-security	Assignee:	Unassigned <unassigned>
Status:	IN PROGRESS IMPLEMENTATION ---	QA Contact:
Severity:	enhancement
Priority:	Medium	CC:	liezhi.yang, matti-pekka.sivosuo, mikko.ylinen, randy.macleod, sgw, tim.orling
Version:	2.4
Target Milestone:	Future
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)

Description Patrick Ohly 2017-05-05 07:06:25 UTC

Currently, whole-disk encryption only works with TPM v1.2. TPM in firmware (aka fTPM) is based on TPM v2.0.

This issue here covers:
- enabling the TPM 2.0 userspace = https://github.com/01org/tpm2.0-tools
- adding the necessary kernel configuration (if needed)
- adding a "tpm2.0" image and distro feature, with the corresponding changes to
  the code which currently only supports tpm1.2 (initramfs, installer): as for 
  1.2, usage of 2.0 is meant to be optional with parameters to make it mandatory
- testing under qemu, using the experimental 
  https://github.com/stefanberger/swtpm/tree/tpm2-preview

*Not* covered is testing on real hardware. Joule might work, but testing and automating that is something that needs to be done by QA.

Comment 1 Patrick Ohly 2017-08-01 11:26:03 UTC

https://github.com/pohly/intel-iot-refkit/commits/tpm2 contains my work-in-progress changes. Currently it only allows building tpm2.0-tools from meta-measured.

Clearly I am not going to finish this for M2, so I propose moving it to M3.

Comment 2 Tim Orling 2020-06-25 08:20:13 UTC

Still valid and should be possible to refactor refkit implementation.

Comment 3 Tim Orling 2024-06-06 15:20:20 UTC

Unfortunately, meta-measured (https://github.com/flihp/meta-measured) is now marked as archived.

The most current tpm support is in meta-tpm (https://git.yoctoproject.org/meta-security/tree/meta-tpm)

The number of recipes there is probably too much to move into oe-core, so we might want to create a reference implementation in meta-security. Hopefully one that could be tested on the AutoBuilder.

Comment 4 Randy MacLeod 2025-02-14 16:46:29 UTC

bulk change to add Saul's non-WR address.

Comment 5 Randy MacLeod 2025-02-14 16:48:27 UTC

Bulk change: Remove Saul's old WR address.