mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
kaf24@firebug.cl.cam.ac.uk
20e8ba075b
The VTPM manager and VTPMs fully support both 32 and 64 bit OSes. The tpm_emulator (provided for debugging on TPM-less machines) does not support 64-bit kernels by default though. See the README for details on how to use it on 64-bit kernels. (Vinnie Scarlata, Intel Corporation) Signed-off-by: Joe Cihula <joe.cihula@intel.com>
100 lines
4.9 KiB
Plaintext
100 lines
4.9 KiB
Plaintext
// ===================================================================
|
|
//
|
|
// Copyright (c) 2005, Intel Corp.
|
|
// All rights reserved.
|
|
//
|
|
// Redistribution and use in source and binary forms, with or without
|
|
// modification, are permitted provided that the following conditions
|
|
// are met:
|
|
//
|
|
// * Redistributions of source code must retain the above copyright
|
|
// notice, this list of conditions and the following disclaimer.
|
|
// * Redistributions in binary form must reproduce the above
|
|
// copyright notice, this list of conditions and the following
|
|
// disclaimer in the documentation and/or other materials provided
|
|
// with the distribution.
|
|
// * Neither the name of Intel Corporation nor the names of its
|
|
// contributors may be used to endorse or promote products derived
|
|
// from this software without specific prior written permission.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
// COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
// INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
// OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
// ===================================================================
|
|
|
|
Directory Structure
|
|
===================
|
|
tools/vtpm_manager/crypto -> crypto files
|
|
tools/vtpm_manager/TCS -> TCS implementation
|
|
tools/vtpm_manager/util -> Utility Library. Include disk-io and buffers.
|
|
tools/vtpm_manager/manager -> VTPM Manager
|
|
|
|
Compile Flags
|
|
===================
|
|
LOGGING_MODULES -> How extensive logging happens
|
|
see util/log.h for more info
|
|
|
|
VTPM_MULTI_VM -> Defined: VTPMs run in their own VMs
|
|
Not Defined (default): VTPMs are processes
|
|
|
|
# Debugging flags that may disappear without notice in the future
|
|
|
|
DUMMY_BACKEND -> vtpm_manager listens on /tmp/in.fifo and
|
|
/tmp/out.fifo rather than backend
|
|
|
|
MANUAL_DM_LAUNCH -> Must manually launch & kill VTPMs
|
|
|
|
WELL_KNOWN_SRK_AUTH -> Rather than randomly generating the password for the SRK,
|
|
use a well known value. This is necessary for sharing use
|
|
of the SRK across applications. Such as VTPM and Dom0
|
|
measurement software.
|
|
|
|
WELL_KNOWN_OWNER_AUTH -> Rather than randomly generating the password for the owner,
|
|
use a well known value. This is useful for debugging and for
|
|
poor bios which do not support clearing TPM if OwnerAuth is
|
|
lost. However this has no protection from malicious app
|
|
issuing a TPM_OwnerClear to wipe the TPM
|
|
|
|
Requirements
|
|
============
|
|
- xen-unstable
|
|
- vtpm frontend/backend driver patch
|
|
- OpenSSL Library
|
|
|
|
Single-VM Flow
|
|
============================
|
|
- Launch the VTPM manager (vtpm_managerd) which which begins listening to the BE with one thread
|
|
and listens to a named fifo that is shared by the vtpms to commuincate with the manager.
|
|
- VTPM Manager listens to TPM BE.
|
|
- When xend launches a tpm frontend equipped VM it contacts the manager over the vtpm backend.
|
|
- When the manager receives the open message from the BE, it launches a vtpm
|
|
- Xend allows the VM to continue booting.
|
|
- When a TPM request is issued to the front end, the front end transmits the TPM request to the backend.
|
|
- The manager receives the TPM requests and uses a named fifo to forward the request to the vtpm.
|
|
- The fifo listener begins listening for the reply from vtpm for the request.
|
|
- Vtpm processes request and replies to manager over shared named fifo.
|
|
- If needed, the vtpm may send a request to the vtpm_manager at any time to save it's secrets to disk.
|
|
- Manager receives response from vtpm and passes it back to backend for forwarding to guest.
|
|
|
|
NOTES:
|
|
* SaveService SHOULD seal it's table before saving it to disk. However,
|
|
the current Xen infrastructure does not provide a mechanism for this to be
|
|
unsealed later. Specifically, the auth and wrapped key must be available ONLY
|
|
to the service, or it's not even worth encrypting
|
|
|
|
In the future the vtpm manager will be protected by an early boot mechanism
|
|
that will allow for better protection of it's data.
|
|
|
|
TODO:
|
|
- Timeout on crashed vtpms
|
|
- create lock for shared fifo for talking to vtpms.
|