Bug 1693205

Summary:	edk2: Enable TPM2 support
Product:	Red Hat Enterprise Linux 8	Reporter:	Marc-Andre Lureau <marcandre.lureau>
Component:	edk2	Assignee:	Laszlo Ersek <lersek>
Status:	CLOSED ERRATA	QA Contact:	Virtualization Bugs <virt-bugs>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	8.0	CC:	berrange, jinzhao, juzhang, knoel, kraxel, lersek, mrezanin, mtessun, pbonzini, philmd, wchadwic, xfu
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	edk2-20190308git89910a39dcfd-5.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-05 20:44:44 UTC	Type:	Feature Request
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1687731
Bug Blocks:	1519013

Description Marc-Andre Lureau 2019-03-27 10:45:17 UTC

Emulated TPM2 support requires OVMF support, from commit d20ae95a13e851d56c6618108b18c93526505ca2 and earlier.

That commit is part of the edk2 tag "edk2-stable201903", which RHEL-8.1 targets (https://bugzilla.redhat.com/show_bug.cgi?id=1687731)

however, we'd need to modify the build flags in the SPEC file (and the
ad-hoc testing instructions in the README), to specify TPM2_ENABLE. (And
maybe TPM2_CONFIG_ENABLE too, but I'd strongly prefer if we left out
TPM2_CONFIG_ENABLE -- I think we can promise supporting TPM2_ENABLE, but
TPM2_CONFIG_ENABLE is totally immature for that.)

Comment 1 Laszlo Ersek 2019-03-27 11:21:03 UTC

Once an official Brew build is available for prerequisite bug 1687731, I'll prepare a scratch build (with the build flag changes that are necessary), for Marc-André to check. I'll set devel_ack+ when he confirms the build is OK.

Comment 18 Laszlo Ersek 2019-06-25 00:49:59 UTC

FuXiangChun, this BZ should be sanity checked both with and without an
swtpm configured. Regarding the former case, I defer to Marc-André. In
the latter case (no swtpm), the following two changes in behavior are
expected:

- the boot might take slightly longer

- in the OVMF debug log, you should see messages like:

> Tcg2ConfigPeimEntryPoint: no TPM2 detected
> ...
> No TPM2 instance required!
> ...
> DxeTpm2MeasureBootHandler - Tcg2 - Not Found
> ...
> WARNING: Tpm2RegisterTpm2DeviceLib - does not support
> 286BF25A-C2C3-408C-B3B4-25E6758B7317 registration

Thanks.

Comment 38 errata-xmlrpc 2019-11-05 20:44:44 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3338