mirror of
https://git.yoctoproject.org/poky
synced 2026-04-26 00:32:12 +02:00
81b7a9832f
This enables the use of swtpm (from meta-security) as a virtual TPM in qemu. These patches extend the existing support in qemu for TPM passthrough so that a swtpm daemon can be accessed via CUSE (character device in user space). To use this: - add the meta-security layer including the swtpm enhancements for qemu - bitbake swtpm-native - create a TPM instance and initialize it with: $ mkdir -p my-machine/myvtpm0 $ tmp-glibc/sysroots/x86_64-linux/usr/bin/swtpm_setup_oe.sh --tpm-state my-machine/myvtpm0 --createek Starting vTPM manufacturing as root:root @ Fri 20 Jan 2017 08:56:18 AM CET TPM is listening on TCP port 52167. Successfully created EK. Successfully authored TPM state. Ending vTPM manufacturing @ Fri 20 Jan 2017 08:56:19 AM CET - run swtpm *before each runqemu invocation* (it shuts down after use) and do it as root (required to set up the /dev/vtpm0 CUSE device): $ sudo sh -c 'PATH=`pwd`/tmp-glibc/sysroots/x86_64-linux/usr/bin/:`pwd`/tmp-glibc/sysroots/x86_64-linux/usr/sbin/:$PATH; export TPM_PATH=`pwd`/my-machine/myvtpm0; swtpm_cuse -n vtpm0' && sudo chmod a+rw /dev/vtpm0 - run qemu: $ runqemu 'qemuparams=-tpmdev cuse-tpm,id=tpm0,path=/dev/vtpm0 -device tpm-tis,tpmdev=tpm0' ... The guest kernel has to have TPM support enabled, which can be done with: KERNEL_FEATURES_append = " features/tpm/tpm.scc" (From OE-Core rev: 1264d26fa251ac11a9069f3e602dec6be9d8b9ba) Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>