Commit ff66c00b authored by Jonathan Corbet's avatar Jonathan Corbet

Merge branch 'tpm' into docs-next

parents 78566cf1 799a545b
...@@ -57,6 +57,7 @@ needed). ...@@ -57,6 +57,7 @@ needed).
media/index media/index
gpu/index gpu/index
80211/index 80211/index
security/index
Indices and tables Indices and tables
================== ==================
......
======================
Security documentation
======================
.. toctree::
tpm/index
=====================================
Trusted Platform Module documentation
=====================================
.. toctree::
tpm_vtpm_proxy
=============================================
Virtual TPM Proxy Driver for Linux Containers Virtual TPM Proxy Driver for Linux Containers
=============================================
Authors: Stefan Berger (IBM) | Authors:
| Stefan Berger <stefanb@linux.vnet.ibm.com>
This document describes the virtual Trusted Platform Module (vTPM) This document describes the virtual Trusted Platform Module (vTPM)
proxy device driver for Linux containers. proxy device driver for Linux containers.
INTRODUCTION Introduction
------------ ============
The goal of this work is to provide TPM functionality to each Linux The goal of this work is to provide TPM functionality to each Linux
container. This allows programs to interact with a TPM in a container container. This allows programs to interact with a TPM in a container
the same way they interact with a TPM on the physical system. Each the same way they interact with a TPM on the physical system. Each
container gets its own unique, emulated, software TPM. container gets its own unique, emulated, software TPM.
Design
DESIGN ======
------
To make an emulated software TPM available to each container, the container To make an emulated software TPM available to each container, the container
management stack needs to create a device pair consisting of a client TPM management stack needs to create a device pair consisting of a client TPM
character device /dev/tpmX (with X=0,1,2...) and a 'server side' file character device ``/dev/tpmX`` (with X=0,1,2...) and a 'server side' file
descriptor. The former is moved into the container by creating a character descriptor. The former is moved into the container by creating a character
device with the appropriate major and minor numbers while the file descriptor device with the appropriate major and minor numbers while the file descriptor
is passed to the TPM emulator. Software inside the container can then send is passed to the TPM emulator. Software inside the container can then send
TPM commands using the character device and the emulator will receive the TPM commands using the character device and the emulator will receive the
commands via the file descriptor and use it for sending back responses. commands via the file descriptor and use it for sending back responses.
To support this, the virtual TPM proxy driver provides a device /dev/vtpmx To support this, the virtual TPM proxy driver provides a device ``/dev/vtpmx``
that is used to create device pairs using an ioctl. The ioctl takes as that is used to create device pairs using an ioctl. The ioctl takes as
an input flags for configuring the device. The flags for example indicate an input flags for configuring the device. The flags for example indicate
whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator. whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator.
The result of the ioctl are the file descriptor for the 'server side' The result of the ioctl are the file descriptor for the 'server side'
as well as the major and minor numbers of the character device that was created. as well as the major and minor numbers of the character device that was created.
Besides that the number of the TPM character device is return. If for Besides that the number of the TPM character device is returned. If for
example /dev/tpm10 was created, the number (dev_num) 10 is returned. example ``/dev/tpm10`` was created, the number (``dev_num``) 10 is returned.
The following is the data structure of the TPM_PROXY_IOC_NEW_DEV ioctl:
struct vtpm_proxy_new_dev {
__u32 flags; /* input */
__u32 tpm_num; /* output */
__u32 fd; /* output */
__u32 major; /* output */
__u32 minor; /* output */
};
Note that if unsupported flags are passed to the device driver, the ioctl will
fail and errno will be set to EOPNOTSUPP. Similarly, if an unsupported ioctl is
called on the device driver, the ioctl will fail and errno will be set to
ENOTTY.
See /usr/include/linux/vtpm_proxy.h for definitions related to the public interface
of this vTPM device driver.
Once the device has been created, the driver will immediately try to talk Once the device has been created, the driver will immediately try to talk
to the TPM. All commands from the driver can be read from the file descriptor to the TPM. All commands from the driver can be read from the file descriptor
returned by the ioctl. The commands should be responded to immediately. returned by the ioctl. The commands should be responded to immediately.
Depending on the version of TPM the following commands will be sent by the UAPI
driver: ====
- TPM 1.2: .. kernel-doc:: include/uapi/linux/vtpm_proxy.h
- the driver will send a TPM_Startup command to the TPM emulator
- the driver will send commands to read the command durations and
interface timeouts from the TPM emulator
- TPM 2:
- the driver will send a TPM2_Startup command to the TPM emulator
The TPM device /dev/tpmX will only appear if all of the relevant commands .. kernel-doc:: drivers/char/tpm/tpm_vtpm_proxy.c
were responded to properly. :functions: vtpmx_ioc_new_dev
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment