TPMv2 support plan for heads?

[citypw]

Hi heads maintainers,

We've been testing heads on x230 for a while and we aware of that the current version of heads doesn't support TPMv2. Do you guys have a plan for TPMv2 support or a TODO-list?

[osresearch]

TPMv2 is definitely on the list of "must have eventually". The kernel support is there, but the userspace library hasn't been updated.

One problem with many TPM2 systems is that they are implemented inside the ME. If you use the me_cleaner tool it will also eliminate the ability to use the fTPM.

[citypw]

Damn, I didn't know ME come into play. We tested it this tool on GNU/Linux. Not sure there's any different if we try to port it to heads.

@persmule , have you try tpm_pcrtool on the machine w/ ME neutralized?

[persmule]

@citypw Yes, I have confirmed tpm_pcrtool working on a coreboot-powered gigabyte's ga-b75m-d3h with a TPM2 installed on its TPM socket connected to LPC, and with ME neutralized.

[citypw]

Ok, we haven't test TPMv2 on many systems, only ga-b75M-D3H( Sandybridge/Ivybridge). When does ME have the fTPM code module? MEv11 or earlier version?

[tlaurion]

@citypw @persmule : i'm confronted with the same problem on the kgpe-d16 port i'm doing.

The kgpe-d16 supports a 19 pin TPM2 device, wrongly detected as a SLB9660:

lpc_tpm: Read reg 0xf00 returns 0x1a15d1
Found TPM SLB9660 TT 1.2 by Infineon
TPM: Open

What is written on the chip is actually "SLB9665f120". From what I understand from the pc80 source, that device is not detected correctly, and as a result, the 1.2 initialization is done which doesn't work.

Here, an article and video covering the same issue on coreboot.

For coreboot to support TPM2 on a board, that board Kconfig should select TPM2.
The result in heads is the following, with mismatch coming from different libraries with Measured Boot activated:

src/lib/tpm2_tlcl.c:309:10: error: conflicting types for 'tlcl_define_space'
uint32_t tlcl_define_space(uint32_t space_index, size_t space_size)
^~~~~~~~~~~~~~~~~
In file included from src/lib/tpm2_tlcl_structures.h:16:0,
from src/lib/tpm2_tlcl.c:11:
src/include/tpm_lite/tlcl.h:65:10: note: previous declaration of 'tlcl_define_space' was here
uint32_t tlcl_define_space(uint32_t index, uint32_t perm, uint32_t size);
^~~~~~~~~~~~~~~~~
make[2]: *** [Makefile:337: kgpe-d16/ramstage/lib/tpm2_tlcl.o] Error 1
make[2]: *** Waiting for unfinished jobs....
make[2]: Leaving directory '/home/user/Downloads/heads-kgpe-d16/build/coreboot-4.7'
make[1]: *** [Makefile:231: coreboot.intermediate] Error 1
make[1]: Leaving directory '/home/user/Downloads/heads-kgpe-d16'
Makefile:452: recipe for target 'all' failed
make: *** [all] Error 2

I searched both your gists and found no recipes in regard of TPM2 activation and toolset usage. Could you share a bit on what you have done so far and accomplished?

[persmule]

@tlaurion I have once built coreboot with Heads' patch and Heads as payload (I always deploy Heads in this way, especially for boards already supported by coreboot, but not by Heads EXPLICITLY, e.g. my t430s, elitebook revolve 810 g1, as well as x200s, which has no TPM capability with its ME REMOVED, so I wrote a patch to make it optional) for my GA-B75M-D3H board (which has been supported by coreboot, and has a spare 20-1 pin TPM socket) with a TPM2 plugged in. During this test, I noticed that the user space library and tool that Heads uses to operate TPM (libtpm) is designed only for TPM1.

[tlaurion]

@persmule Thanks. For the 9665 chip, I just saw that there is a patch stuck in review. Will test it.

Edit: applying the patch makes the initialization right:

lpc_tpm: Read reg 0xf00 returns 0x1a15d1
Found TPM SLB9665 TT 2.0 by Infineon
TPM: Open

@osresearch : What toolset would you want supported in heads? tpm2-tools? tpm2-software?

see #134.

[tlaurion]

@zaolin : I saw your VBOOT patches to coreboot. What would be the implications of using it in heads for boards like the x230 regarding the presence of multiple copies being kept (backup purpose) and space constraints?

[tlaurion]

I didn't make the links between ftpm deactivation following me_cleaner application. So the x230 couldn't have tpm2 support.

Is there enough interest to actually try to support IBM TSS implementation?