x86: How to Initialize TPM Using BIOS

On x86 systems, you perform steps on the system's BIOS before initializing the service using Oracle Solaris.

1. At the Oracle Solaris prompt, reboot the system.

    # reboot -p

2. While the system is booting, press F2 to access the BIOS menu.
3. Using BIOS menu options, configure TPM.
   1. Navigate to Advanced → Trusted Computing.
   2. Set TPM by specifying values for the following menu items.

      TCG/TPM Support [Yes]
      Execute TPM Command [Enabled]

   3. Press the Esc key to exit the BIOS menu.
   4. Choose Save Changes and Exit.
   5. To proceed with the boot process, choose Ok.
4. After the boot process is completed, enable the tcsd daemon.

   # svcadm enable -s svc:/application/security/tcsd

5. Initialize TPM.

   Initializing TPM causes you to become a TPM owner and requires you to assign an owner password.

   # tpmadm init
   TPM Owner PIN:
   Confirm TPM Owner PIN

6. Verify the status of TPM.

    # tpmadm status
   TPM Version: 1.2 (ATML Rev: 13.9, SpecLevel: 2, ErrataRev: 1)
   TPM resources
   Contexts: 16/16 available
   Sessions: 2/3 available
   Auth Sessions: 2/3 available
   Loaded Keys: 18/21 available
   Platform Configuration Registers (24)
   PCR 0: E1 EE 40 D8 66 28 A9 08 B6 22 8E AF DC 3C BC 23 71 15 49 31
   PCR 1: 5B 93 BB A0 A6 64 A7 10 52 59 4A 70 95 B2 07 75 77 03 45 0B
   PCR 2: 5B 93 BB A0 A6 64 A7 10 52 59 4A 70 95 B2 07 75 77 03 45 0B
   PCR 3: 5B 93 BB A0 A6 64 A7 10 52 59 4A 70 95 B2 07 75 77 03 45 0B
   PCR 4: AF 98 77 B8 72 82 94 7D BE 09 25 10 2E 60 F9 60 80 1E E6 7C
   PCR 5: E1 AA 8C DF 53 A4 23 BF DB 2F 4F 0F F2 90 A5 45 21 D8 BF 27
   PCR 6: 5B 93 BB A0 A6 64 A7 10 52 59 4A 70 95 B2 07 75 77 03 45 0B
   PCR 7: 5B 93 BB A0 A6 64 A7 10 52 59 4A 70 95 B2 07 75 77 03 45 0B
   PCR 8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 9: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 11: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 12: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 13: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 14: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 15: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   PCR 17: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
   PCR 18: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
   PCR 19: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
   PCR 20: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
   PCR 21: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
   PCR 22: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
   PCR 23: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   

7. (Optional) Enable the TPM crypto provider.

   ---

   Note -  The TPM crypto provider is slower than Oracle Solaris. Therefore, perform this step only if you want TPM to perform cryptographic operations.

   ---

   # cryptoadm install provider='/usr/lib/security/$ISA/pkcs11_tpm.so'
   # cryptoadm list -mv provider='/usr/lib/security/$ISA/pkcs11_tpm.so'