1. Cip-Dev
  2. Topics

[isar-cip-core][PATCH v3 4/8] start-qemu.sh: Create a tpm2 device

Quirin Gylstorff
 

From: Quirin Gylstorff <quirin.gylstorff@...>

This allows testing the tpm2 encryption with qemu.

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@...>
---
start-qemu.sh | 27 ++++++++++++++++++++++-----
1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/start-qemu.sh b/start-qemu.sh
index dd16aed..c06d21e 100755
--- a/start-qemu.sh
+++ b/start-qemu.sh
@@ -28,6 +28,9 @@ if grep -s -q "IMAGE_SECURE_BOOT: true" .config.yaml; then
elif grep -s -q "IMAGE_SWUPDATE: true" .config.yaml; then
SWUPDATE_BOOT="true"
fi
+if grep -s -q "IMAGE_TPM2_ENCRYPTION: true" .config.yaml; then
+ TPM2_ENCRYPTION="true"
+fi

if [ -n "${QEMU_PATH}" ]; then
QEMU_PATH="${QEMU_PATH}/"
@@ -139,7 +142,21 @@ QEMU_COMMON_OPTIONS=" \
-m 1G \
-serial mon:stdio \
-netdev user,id=net,hostfwd=tcp:127.0.0.1:22222-:22 \
- ${QEMU_EXTRA_ARGS}"
+ "
+
+if [ "$TPM2_ENCRYPTION" = "true" ] && [ -x /usr/bin/swtpm ]; then
+ swtpm_dir="/tmp/qemu-swtpm"
+ mkdir -p "${swtpm_dir}"
+ rm "${swtpm_dir}"/*
+ if swtpm socket -d --tpmstate dir="${swtpm_dir}" \
+ --ctrl type=unixio,path="${swtpm_dir}"/sock \
+ --tpm2; then
+ QEMU_EXTRA_ARGS="${QEMU_EXTRA_ARGS} \
+ -chardev socket,id=chrtpm,path=${swtpm_dir}/sock \
+ -tpmdev emulator,id=tpm0,chardev=chrtpm \
+ -device tpm-tis,tpmdev=tpm0"
+ fi
+fi

if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then
case "${arch}" in
@@ -154,14 +171,14 @@ if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then
-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
-drive if=pflash,format=raw,file=${ovmf_vars} \
-drive file=${IMAGE_PREFIX}.wic,discard=unmap,if=none,id=disk,format=raw \
- ${QEMU_COMMON_OPTIONS} "$@"
+ ${QEMU_COMMON_OPTIONS} ${QEMU_EXTRA_ARGS} "$@"
else
ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.fd}

${QEMU_PATH}${QEMU} \
-drive file=${IMAGE_PREFIX}.wic,discard=unmap,if=none,id=disk,format=raw \
-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
- ${QEMU_COMMON_OPTIONS} "$@"
+ ${QEMU_COMMON_OPTIONS} ${QEMU_EXTRA_ARGS} "$@"
fi
;;
arm64|aarch64|arm|armhf)
@@ -170,7 +187,7 @@ if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then
${QEMU_PATH}${QEMU} \
-drive file=${IMAGE_PREFIX}.wic,discard=unmap,if=none,id=disk,format=raw \
-bios ${u_boot_bin} \
- ${QEMU_COMMON_OPTIONS} "$@"
+ ${QEMU_COMMON_OPTIONS} ${QEMU_EXTRA_ARGS} "$@"
;;
*)
echo "Unsupported architecture: ${arch}"
@@ -187,5 +204,5 @@ else
-drive file=${IMAGE_FILE},discard=unmap,if=none,id=disk,format=raw \
-kernel ${KERNEL_FILE} -append "${KERNEL_CMDLINE}" \
-initrd ${INITRD_FILE} \
- ${QEMU_COMMON_OPTIONS} "$@"
+ ${QEMU_COMMON_OPTIONS} ${QEMU_EXTRA_ARGS} "$@"
fi
--
2.39.1

Jan Kiszka
 

On 24.02.23 17:28, Quirin Gylstorff wrote:
From: Quirin Gylstorff <quirin.gylstorff@...>

This allows testing the tpm2 encryption with qemu.

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@...>
---
start-qemu.sh | 27 ++++++++++++++++++++++-----
1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/start-qemu.sh b/start-qemu.sh
index dd16aed..c06d21e 100755
--- a/start-qemu.sh
+++ b/start-qemu.sh
@@ -28,6 +28,9 @@ if grep -s -q "IMAGE_SECURE_BOOT: true" .config.yaml; then
elif grep -s -q "IMAGE_SWUPDATE: true" .config.yaml; then
SWUPDATE_BOOT="true"
fi
+if grep -s -q "IMAGE_TPM2_ENCRYPTION: true" .config.yaml; then
+ TPM2_ENCRYPTION="true"
Inconsistent indention with spaces.

+fi

if [ -n "${QEMU_PATH}" ]; then
QEMU_PATH="${QEMU_PATH}/"
@@ -139,7 +142,21 @@ QEMU_COMMON_OPTIONS=" \
-m 1G \
-serial mon:stdio \
-netdev user,id=net,hostfwd=tcp:127.0.0.1:22222-:22 \
- ${QEMU_EXTRA_ARGS}"
+ "
+
+if [ "$TPM2_ENCRYPTION" = "true" ] && [ -x /usr/bin/swtpm ]; then
+ swtpm_dir="/tmp/qemu-swtpm"
+ mkdir -p "${swtpm_dir}"
+ rm "${swtpm_dir}"/*
+ if swtpm socket -d --tpmstate dir="${swtpm_dir}" \
+ --ctrl type=unixio,path="${swtpm_dir}"/sock \
+ --tpm2; then
+ QEMU_EXTRA_ARGS="${QEMU_EXTRA_ARGS} \
+ -chardev socket,id=chrtpm,path=${swtpm_dir}/sock \
+ -tpmdev emulator,id=tpm0,chardev=chrtpm \
+ -device tpm-tis,tpmdev=tpm0"
A bit over-indented.

+ fi
+fi

if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then
case "${arch}" in
@@ -154,14 +171,14 @@ if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then
-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
-drive if=pflash,format=raw,file=${ovmf_vars} \
-drive file=${IMAGE_PREFIX}.wic,discard=unmap,if=none,id=disk,format=raw \
- ${QEMU_COMMON_OPTIONS} "$@"
+ ${QEMU_COMMON_OPTIONS} ${QEMU_EXTRA_ARGS} "$@"
else
ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.fd}

${QEMU_PATH}${QEMU} \
-drive file=${IMAGE_PREFIX}.wic,discard=unmap,if=none,id=disk,format=raw \
-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
- ${QEMU_COMMON_OPTIONS} "$@"
+ ${QEMU_COMMON_OPTIONS} ${QEMU_EXTRA_ARGS} "$@"
fi
;;
arm64|aarch64|arm|armhf)
@@ -170,7 +187,7 @@ if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then
${QEMU_PATH}${QEMU} \
-drive file=${IMAGE_PREFIX}.wic,discard=unmap,if=none,id=disk,format=raw \
-bios ${u_boot_bin} \
- ${QEMU_COMMON_OPTIONS} "$@"
+ ${QEMU_COMMON_OPTIONS} ${QEMU_EXTRA_ARGS} "$@"
;;
*)
echo "Unsupported architecture: ${arch}"
@@ -187,5 +204,5 @@ else
-drive file=${IMAGE_FILE},discard=unmap,if=none,id=disk,format=raw \
-kernel ${KERNEL_FILE} -append "${KERNEL_CMDLINE}" \
-initrd ${INITRD_FILE} \
- ${QEMU_COMMON_OPTIONS} "$@"
+ ${QEMU_COMMON_OPTIONS} ${QEMU_EXTRA_ARGS} "$@"
fi
Jan

--
Siemens AG, Technology
Competence Center Embedded Linux

1 - 2 of 2