mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Keir Fraser
b0ae5f8bd1
The newer version of the emulator contains several bug fixes, one that we were seeing in our use of vtpm. This patch also defines TPM_STRONG_PERSISTENCE for the new emulator. A couple of important notes about this patch: -This has only been tested on PVM domU's. In theory it should work for HVM but I have not tried it at all and can guarantee nothing. -All the relevant changes in tools/vtpm/vtpm.patch have been ported to tpm_emulator-0.5.1. -None of the changes in tpm_emulator.patch have been ported. In particular this means the BUILD_EMULATOR option, which as I understand lets you use the tpm_emulator in dom0 for a machine that does not have a real hardware TPM does not work. This functionality should be easy to add though because the new emulator already comes with a kernel module interface. -No considerations were made for the VTPM_MULTI_VM feature (which is supposedly unfinished). This patch may or may not break any progress made on that feature. Signed-off-by: Matt Fioravante <Matthew.Fioravante@jhuapl.edu>
Directory Structure
===================
tools/vtpm/tpm_emulator-0.2b.tar.gz -> TPM Emulator downloaded at build time that will
be patched and used for our vtpms
tools/vtpm/vtpm.patch -> patch applied to tpm_emulator to make vtpm
tools/vtpm/vtpm/ -> (created on build) tpm_emulator moved to ring 3,
listens on a pair of fifos for TPM commands,
persistent state is sent via named fifo to vtpm
manager, which encrypts it and protects it.
tools/vtpm/tpm_emulator.patch -> To allow for debugging and testing on non-TPM
platforms, this patches the emulator to allow
it to be inserted into the dom0 kernel
tools/vtpm/tpm_emulator-0.2 -> (created on build) directory containing patched emulator
Compile Flags
===================
VTPM_MULTI_VM -> Defined (not finished): VTPMs run in their own VMs
Not Defined (default): VTPMs are processes
Requirements
============
- xen-unstable
- IBM frontend/backend vtpm driver patch
- vtpm_managerd
- GNU MP Big number library (GMP)
vtpmd Flow (for vtpm_manager. vtpmd never run by default)
============================
- Launch the VTPM manager (vtpm_managerd) which which begins listening to the BE with one thread
and listens to a named fifo that is shared by the vtpms to commuincate with the manager.
- VTPM Manager listens to TPM BE.
- When xend launches a tpm frontend equipped VM it contacts the manager over the vtpm backend.
- When the manager receives the open message from the BE, it launches a vtpm
- Xend allows the VM to continue booting.
- When a TPM request is issued to the front end, the front end transmits the TPM request to the backend.
- The manager receives the TPM requests and uses a named fifo to forward the request to the vtpm.
- The fifo listener begins listening for the reply from vtpm for the request.
- Vtpm processes request and replies to manager over shared named fifo.
- If needed, the vtpm may send a request to the vtpm_manager at any time to save it's secrets to disk.
- Manager receives response from vtpm and passes it back to backend for forwarding to guest.
tpm_emulator flow
==================
Read documentation in tpm_emulator-0.2 directory