Skip to content

Commit d729de9

Browse files
dgarskedgarske
committed
Added TCG TPM to the SWTPM documentation. Various document cleanups.
1 parent 22b324f commit d729de9

1 file changed

Lines changed: 59 additions & 50 deletions

File tree

‎docs/SWTPM.md‎

Lines changed: 59 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,64 @@
11
# wolfTPM with Software Simulator (SWTPM) support
22

3-
wolfTPM is to be able to interface with software TPM (SW TPM) interfaces defined by section D.3 of [TPM-Rev-2.0-Part-4-Supporting-Routines-01.38-code](https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-4-Supporting-Routines-01.38-code.pdf)
4-
5-
The SWTPM interface is not compatible with TIS or devtpm (/dev/tpm0). Transport is a socket connection by default, but can also be a UART.
6-
7-
This implementation only uses the TPM command interface typically on port 2321. It does not support the Platform interface typically on port 2322.
3+
wolfTPM is to be able to use Software TPM (SW TPM) defined by section D.3 of [TPM-Rev-2.0-Part-4-Supporting-Routines-01.38-code](https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-4-Supporting-Routines-01.38-code.pdf)
84

95
Software TPM implementations tested:
10-
* https://github.com/kgoldman/ibmswtpm2 or https://sourceforge.net/projects/ibmswtpm2/files/
11-
* https://github.com/microsoft/ms-tpm-20-ref
12-
* https://github.com/stefanberger/swtpm
6+
* [Official TCG Reference](https://github.com/TrustedComputingGroup/TPM): Reference code from the specification maintained by TCG [build steps](#tcg-tpm)
7+
* [IBM / Ken Goldman](https://github.com/kgoldman/ibmswtpm2): Fork of reference code maintained by IBM [build steps](#ibmswtpm2)
8+
* [Microsoft](https://github.com/microsoft/ms-tpm-20-ref): Fork of reference code maintained by Microsoft (93% identical to official TCG) [build steps](#ms-tpm-20-ref)
9+
* [Stefan Berger](https://github.com/stefanberger/swtpm): Uses libtpms front end interfaces. [build steps](#swtpm)
1310

14-
## Building SW TPM support
11+
The software TPM transport is a socket connection by default, but we also support a UART.
1512

16-
By default a socket transport will be used.
13+
This implementation only uses the TPM command interface typically on port 2321. It does not support the Platform interface typically on port 2322.
14+
15+
Some software TPM implementations require sending power up and startup commands on the platform interface before the command interface is enabled. You can use these commands to issue the required power up and startup:
1716

1817
```sh
19-
./configure --enable-swtpm
20-
make
18+
echo -ne "\x00\x00\x00\x01" | nc 127.0.0.1 2322
19+
echo -ne "\x00\x00\x00\x0B" | nc 127.0.0.1 2322
2120
```
2221

23-
### Build SW TPM with UART transport
22+
## wolfTPM SWTPM support
23+
24+
To enable the socket transport for SWTPM use `--enable-swtpm`. By default all software TPM simulators use TCP port 2321.
2425

2526
```sh
26-
./configure --enable-swtpm=uart
27+
./configure --enable-swtpm
2728
make
2829
```
2930

30-
## Build Options
31+
Note: It is not possible to enable more than one transport interface at a time. If building with SWTPM socket interface the built-in TIS and devtpm (/dev/tpm0) interfaces are not available.
32+
33+
Build Options:
3134

3235
* `WOLFTPM_SWTPM`: Use socket transport (no TIS layer)
33-
* `TPM2_SWTPM_HOST`: The serial device to use (default=/dev/ttyS0)
34-
* `TPM2_SWTPM_PORT`: The baud rate (default=115200)
35-
* `WOLFTPM_SWTPM_UART`: Use UART transport (no TIS layer)
36+
* `TPM2_SWTPM_HOST`: The socket host (default is localhost)
37+
* `TPM2_SWTPM_PORT`: The socket port (default is 2321)
3638

37-
## SWTPM simulator setup
3839

39-
### Xilinx UART
40+
## Using a SWTPM
4041

41-
Alternatively for raw API calls with Xilinx
42+
### TCG TPM
4243

4344
```sh
44-
./cofnigure --enable-swtpm=uartns550
45+
clone git@github.com:TrustedComputingGroup/TPM.git
46+
cd TPM
47+
cd TPMCmd
48+
./bootstrap
49+
./configure
4550
make
4651
```
4752

48-
## Build Options
53+
Run with: `./Simulator/src/tpm2-simulator`
54+
55+
To use the TPM on port 2321 you must first connect to the platform server on port 2322 and send the power on and startup commands. An easy way to do this is using:
56+
57+
```sh
58+
echo -ne "\x00\x00\x00\x01" | nc 127.0.0.1 2322
59+
echo -ne "\x00\x00\x00\x0B" | nc 127.0.0.1 2322
60+
```
4961

50-
* `WOLFTPM_SWTPM`: Use socket transport (no TIS layer)
51-
* `TPM2_SWTPM_PORT`: Used as the default baud rate (default=115200)
52-
* `TPM2_SWTPM_HOST`: The device to connect with (default=XPAR_MB0_AXI_UART16550_2_DEVICE_ID)
53-
* `WOLFTPM_SWTPM_UARTNS550`: Use Xilinx UART transport (no TIS layer)
5462

5563
### ibmswtpm2
5664

@@ -61,12 +69,10 @@ cd ibmswtpm2/src/
6169
make
6270
```
6371

64-
Running:
65-
```sh
66-
./tpm_server -rm
67-
```
72+
Run with: `./tpm_server`
73+
74+
Note: You can use the `-rm` switch to remove the cache file NVChip. Alternately you can delete the NVChip file (`rm NVChip`)
6875

69-
The rm switch is optional and remove the cache file NVChip. Alternately you can `rm NVChip`
7076

7177
### ms-tpm-20-ref
7278

@@ -76,16 +82,18 @@ cd ms-tpm-20-ref/TPMCmd
7682
./bootstrap
7783
./configure
7884
make
79-
./Simulator/src/tpm2-simulator
8085
```
8186

82-
In another terminal power on ms-tpm-20-ref and start NV
87+
Run with: `./Simulator/src/tpm2-simulator`
88+
89+
To use the TPM on port 2321 you must first connect to the platform server on port 2322 and send the power on and startup commands. An easy way to do this is using:
8390

8491
```sh
85-
echo -ne "\x00\x00\x00\x01" | nc 127.0.0.1 2322 | exit
86-
echo -ne "\x00\x00\x00\x0B" | nc 127.0.0.1 2322 | exit
92+
echo -ne "\x00\x00\x00\x01" | nc 127.0.0.1 2322
93+
echo -ne "\x00\x00\x00\x0B" | nc 127.0.0.1 2322
8794
```
8895

96+
8997
### swtpm
9098

9199
Build libtpms
@@ -125,16 +133,6 @@ mkdir -p /tmp/myvtpm
125133
swtpm socket --tpmstate dir=/tmp/myvtpm --tpm2 --ctrl type=tcp,port=2322 --server type=tcp,port=2321 --flags not-need-init
126134
```
127135

128-
## Running examples
129-
130-
```sh
131-
./examples/pcr/extend
132-
./examples/wrap/wrap_test
133-
```
134-
135-
See `README.md` for more examples
136-
137-
138136
### swtpm with QEMU
139137

140138
This demonstrates using wolfTPM in QEMU to communicate using the linux
@@ -145,7 +143,7 @@ method to build. You may need to consult the instructions for
145143
and
146144
[swtpm](https://github.com/stefanberger/swtpm/wiki#compile-and-install-on-linux)
147145

148-
```
146+
```sh
149147
PREFIX=$PWD/inst
150148
git clone git@github.com:stefanberger/libtpms.git
151149
cd libtpms/
@@ -163,7 +161,7 @@ You can setup a basic linux installation. Other installation bases can
163161
be used. This step will take some time to install the base linux
164162
system.
165163

166-
```
164+
```sh
167165
# download mini install image
168166
curl -O http://archive.ubuntu.com/ubuntu/dists/bionic-updates/main/installer-amd64/current/images/netboot/mini.iso
169167
# create qemu image file
@@ -183,7 +181,7 @@ qemu-system-x86_64 -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
183181
Once a base system is installed it's ready to start the qemu and build
184182
wolfSSL and wolfTPM in the qemu instance.
185183

186-
```
184+
```sh
187185
# start swtpm again
188186
$PREFIX/bin/swtpm socket --tpm2 --tpmstate dir=$PREFIX/mytpm \
189187
--ctrl type=unixio,path=$PREFIX/mytpm/swtpm-sock --log level=20 &
@@ -196,7 +194,7 @@ qemu-system-x86_64 -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
196194

197195
To build checkout and build wolfTPM, in the QEMU terminal
198196

199-
```
197+
```sh
200198
sudo apt install automake libtool gcc git make
201199

202200
# get and build wolfSSL
@@ -219,3 +217,14 @@ popd
219217

220218
You can now run the examples such as `sudo ./examples/wrap/wrap`
221219
within QEMU. Using `sudo` maybe required for access to `/dev/tpm0`.
220+
221+
222+
## Running examples
223+
224+
```sh
225+
./examples/wrap/caps
226+
./examples/pcr/extend
227+
./examples/wrap/wrap_test
228+
```
229+
230+
See [examples/README.md](/examples/README.md) for additional example usage.

0 commit comments

Comments
 (0)