I've asked Stefan Berger @IBM to document the current TPM status in QEMU (guest-visible frontend / behavior, QEMU specifics, currently supported TPM backends, design in general): [Qemu-devel] TPM status http://lists.nongnu.org/archive/html/qemu-devel/2017-06/msg03439.html msgid <7f0b8d00-236d-37e8-5c1f-e7ea8e4b9146@redhat.com> Based on that document, and based on the TianoCore Wiki's TPM instructions at <https://github.com/tianocore/tianocore.github.io/wiki/How-to-Enable-Security#Enabling_Trusted_Compute_Module_TPM>, we should enable TPM support in OVMF. The goal is that a guest OS (incl. its boot loader) running on OVMF can read the TPM event log.
Stefan's v1 docs patch: http://mid.mail-archive.com/1498759215-25382-1-git-send-email-stefanb@linux.vnet.ibm.com
Stefan's v2 docs patch: http://mid.mail-archive.com/1499783493-15911-1-git-send-email-stefanb@linux.vnet.ibm.com http://lists.nongnu.org/archive/html/qemu-devel/2017-07/msg02776.html
Amarnath Valluri's v4 swtpm set: [Qemu-devel] [PATCH v4 0/8] Provide support for the software TPM emulator http://mid.mail-archive.com/1496666711-14630-1-git-send-email-amarnath.valluri@intel.com
From <https://github.com/tianocore/tianocore.github.io/wiki/How-to-Enable-Security#Enabling_Trusted_Compute_Module_TPM>: "Memory should be cleared if ClearMemory bit of variable MemoryOverwriteRequestControl is set when doing memory initialization". This means TPM enablement depends on PEI-phase variable access.
"investigating TPM for OVMF-on-QEMU" http://mid.mail-archive.com/eef9a031-36e9-0443-1d73-30a49df02e9a@redhat.com https://lists.01.org/pipermail/edk2-devel/2017-July/012365.html
Amarnath Valluri's v6 set: [Qemu-devel] [PATCH v6 0/8] Provide support for the software TPM emulator http://lists.nongnu.org/archive/html/qemu-devel/2017-07/msg05507.html
http://mid.mail-archive.com/e8cf7f36-249f-a3cc-f414-fac4e8b56b51@redhat.com
(In reply to Laszlo Ersek from comment #7) > http://mid.mail-archive.com/e8cf7f36-249f-a3cc-f414-fac4e8b56b51@redhat.com alternate link: https://lists.gnu.org/archive/html/qemu-devel/2018-02/msg03497.html
Patch sets from Marc-André: [edk2] [PATCH 0/7] RFC: ovmf: preliminary TPM2 support http://mid.mail-archive.com/20180223132311.26555-1-marcandre.lureau@redhat.com [edk2] [PATCH v2 0/8] RFC: ovmf: preliminary TPM2 support https://lists.01.org/pipermail/edk2-devel/2018-March/022390.html http://mid.mail-archive.com/20180307155746.18526-1-marcandre.lureau@redhat.com
(In reply to Laszlo Ersek from comment #9) > Patch sets from Marc-André: > > [...] moving BZ to IN_PROGRESS status
[edk2] [PATCH v3 0/7] ovmf: preliminary TPM2 support http://mid.mail-archive.com/20180309130918.734-1-marcandre.lureau@redhat.com https://lists.01.org/pipermail/edk2-devel/2018-March/022509.html
Fixed in commit range 7878f706e7eb..d5a002aba0aa, by Marc-André's v3 series (comment 11). Future work (SEV compat, and TPM2 Physical Presence Interface) should be tracked by independent BZs.
