From: Stefan Berger <stefanb@linux.vnet.ibm.com> To: tpmdd-devel@lists.sourceforge.net Cc: jarkko.sakkinen@linux.intel.com, jgunthorpe@obsidianresearch.com, Stefan Berger <stefanb@linux.vnet.ibm.com>, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-api@vger.kernel.org Subject: [PATCH v6 10/11] tpm: Add documentation for the tpm_vtpm device driver Date: Wed, 9 Mar 2016 12:39:29 -0500 [thread overview] Message-ID: <1457545170-30120-11-git-send-email-stefanb@linux.vnet.ibm.com> (raw) In-Reply-To: <1457545170-30120-1-git-send-email-stefanb@linux.vnet.ibm.com> Add documentation for the tpm_vtpm device driver that implements support for providing TPM functionality to Linux containers. Parts of this documentation were recycled from the Xen vTPM device driver documentation. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> CC: linux-kernel@vger.kernel.org CC: linux-doc@vger.kernel.org CC: linux-api@vger.kernel.org --- Documentation/tpm/tpm_vtpm.txt | 54 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 Documentation/tpm/tpm_vtpm.txt diff --git a/Documentation/tpm/tpm_vtpm.txt b/Documentation/tpm/tpm_vtpm.txt new file mode 100644 index 0000000..d193573 --- /dev/null +++ b/Documentation/tpm/tpm_vtpm.txt @@ -0,0 +1,54 @@ +Virtual TPM Device Driver for Linux Containers + +Authors: Stefan Berger (IBM) + +This document describes the virtual Trusted Platform Module (vTPM) device +driver for Linux containers. + +INTRODUCTION +------------ + +The goal of this work is to provide TPM functionality to each Linux +container. This allows programs to interact with a TPM in a container +the same way they interact with a TPM on the physical system. Each +container gets its own unique, emulated, software TPM. + + +DESIGN +------ + +To make an emulated software TPM available to each container, the container +management stack needs to create a device pair consisting of a client TPM +character device /dev/tpmX (with X=0,1,2...) and a 'server side' file +descriptor. The former is moved into the container by creating a character +device with the appropriate major and minor numbers while the file descriptor +is passed to the TPM emulator. Software inside the container can then send +TPM commands using the character device and the emulator will receive the +commands via the file descriptor and use it for sending back responses. + +To support this, the virtual TPM device driver provides a device /dev/vtpmx +that is used to create device pairs using an ioctl. The ioctl takes as +an input flags for configuring the device. The flags for example indicate +whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator. +The result of the ioctl are the file descriptor for the 'server side' +as well as the major and minor numbers of the character device that was created. +Besides that the number of the TPM character device is return. If for +example /dev/tpm10 was created, the number (dev_num) 10 is returned. + +The following is the data structure of the VTPM_NEW_DEV ioctl: + +struct vtpm_new_dev { + __u32 flags; /* input */ + __u32 dev_num; /* output */ + __u32 fd; /* output */ + __u32 major; /* output */ + __u32 minor; /* output */ +}; + +Note that if unsupported flags are passed to the device driver, the ioctl will +fail and errno will be set to EOPNOTSUPP. Similarly, if an unsupported ioctl is +called on the device driver, the ioctl will fail and errno will be set to +ENOTTY. + +See /usr/include/linux/vtpm.h for definitions related to the public interface +of this vTPM device driver. -- 2.4.3
WARNING: multiple messages have this Message-ID (diff)
From: Stefan Berger <stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> To: tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Cc: linux-doc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Subject: [PATCH v6 10/11] tpm: Add documentation for the tpm_vtpm device driver Date: Wed, 9 Mar 2016 12:39:29 -0500 [thread overview] Message-ID: <1457545170-30120-11-git-send-email-stefanb@linux.vnet.ibm.com> (raw) In-Reply-To: <1457545170-30120-1-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> Add documentation for the tpm_vtpm device driver that implements support for providing TPM functionality to Linux containers. Parts of this documentation were recycled from the Xen vTPM device driver documentation. Signed-off-by: Stefan Berger <stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> CC: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org CC: linux-doc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org CC: linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org --- Documentation/tpm/tpm_vtpm.txt | 54 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 Documentation/tpm/tpm_vtpm.txt diff --git a/Documentation/tpm/tpm_vtpm.txt b/Documentation/tpm/tpm_vtpm.txt new file mode 100644 index 0000000..d193573 --- /dev/null +++ b/Documentation/tpm/tpm_vtpm.txt @@ -0,0 +1,54 @@ +Virtual TPM Device Driver for Linux Containers + +Authors: Stefan Berger (IBM) + +This document describes the virtual Trusted Platform Module (vTPM) device +driver for Linux containers. + +INTRODUCTION +------------ + +The goal of this work is to provide TPM functionality to each Linux +container. This allows programs to interact with a TPM in a container +the same way they interact with a TPM on the physical system. Each +container gets its own unique, emulated, software TPM. + + +DESIGN +------ + +To make an emulated software TPM available to each container, the container +management stack needs to create a device pair consisting of a client TPM +character device /dev/tpmX (with X=0,1,2...) and a 'server side' file +descriptor. The former is moved into the container by creating a character +device with the appropriate major and minor numbers while the file descriptor +is passed to the TPM emulator. Software inside the container can then send +TPM commands using the character device and the emulator will receive the +commands via the file descriptor and use it for sending back responses. + +To support this, the virtual TPM device driver provides a device /dev/vtpmx +that is used to create device pairs using an ioctl. The ioctl takes as +an input flags for configuring the device. The flags for example indicate +whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator. +The result of the ioctl are the file descriptor for the 'server side' +as well as the major and minor numbers of the character device that was created. +Besides that the number of the TPM character device is return. If for +example /dev/tpm10 was created, the number (dev_num) 10 is returned. + +The following is the data structure of the VTPM_NEW_DEV ioctl: + +struct vtpm_new_dev { + __u32 flags; /* input */ + __u32 dev_num; /* output */ + __u32 fd; /* output */ + __u32 major; /* output */ + __u32 minor; /* output */ +}; + +Note that if unsupported flags are passed to the device driver, the ioctl will +fail and errno will be set to EOPNOTSUPP. Similarly, if an unsupported ioctl is +called on the device driver, the ioctl will fail and errno will be set to +ENOTTY. + +See /usr/include/linux/vtpm.h for definitions related to the public interface +of this vTPM device driver. -- 2.4.3 ------------------------------------------------------------------------------ Transform Data into Opportunity. Accelerate data analysis in your applications with Intel Data Analytics Acceleration Library. Click to learn more. http://pubads.g.doubleclick.net/gampad/clk?id=278785111&iu=/4140
next prev parent reply other threads:[~2016-03-09 17:40 UTC|newest] Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-03-09 17:39 [PATCH v6 00/11] Multi-instance vTPM driver Stefan Berger [not found] ` <1457545170-30120-1-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2016-03-09 17:39 ` [PATCH v6 01/11] tpm: Get rid of chip->pdev Stefan Berger 2016-03-09 17:39 ` [PATCH v6 02/11] tpm: Get rid of devname Stefan Berger 2016-03-09 17:39 ` [PATCH v6 03/11] tpm: Provide strong locking for device removal Stefan Berger 2016-03-09 17:39 ` [PATCH v6 04/11] tpm: Get rid of module locking Stefan Berger 2016-03-09 17:39 ` [PATCH v6 05/11] tpm: Split out the devm stuff from tpmm_chip_alloc Stefan Berger 2016-03-09 17:39 ` [PATCH v6 06/11] tpm: Replace device number bitmap with IDR Stefan Berger [not found] ` <1457545170-30120-7-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2016-03-10 13:21 ` Jarkko Sakkinen [not found] ` <20160310132156.GA16320-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org> 2016-03-10 16:26 ` Stefan Berger [not found] ` <201603101622.u2AGMCv3031274@d01av05.pok.ibm.com> [not found] ` <201603101622.u2AGMCv3031274-8DuMPbUlb4HImUpY6SP3GEEOCMrvLtNR@public.gmane.org> 2016-03-10 16:40 ` Jarkko Sakkinen 2016-03-09 17:39 ` [PATCH v6 07/11] tpm: Introduce TPM_CHIP_FLAG_VIRTUAL Stefan Berger 2016-03-09 17:39 ` [PATCH v6 11/11] A test program for vTPM device creation Stefan Berger [not found] ` <1457545170-30120-12-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> 2016-03-10 20:57 ` [PATCH v6 11/11] A test program for vTPM devicecreation Stefan Berger [not found] ` <201603102058.u2AKw7Ie013400@d01av04.pok.ibm.com> [not found] ` <201603102058.u2AKw7Ie013400-YREtIfBy6dDImUpY6SP3GEEOCMrvLtNR@public.gmane.org> 2016-03-11 10:30 ` Jarkko Sakkinen [not found] ` <20160311103001.GA13368-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org> 2016-03-11 13:16 ` Stefan Berger 2016-03-09 17:39 ` [PATCH v6 08/11] tpm: Driver for supporting multiple emulated TPMs Stefan Berger 2016-03-09 17:39 ` Stefan Berger 2016-03-09 18:01 ` Andy Lutomirski 2016-03-09 18:01 ` Andy Lutomirski [not found] ` <CALCETrXDfHRdFnqK15o1yD8106sn4e6Susr9j7=GGi4sb-p0qQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> 2016-03-09 18:44 ` Stefan Berger 2016-03-10 2:34 ` Stefan Berger 2016-03-10 2:57 ` Andy Lutomirski 2016-03-10 17:38 ` Stefan Berger 2016-03-10 17:38 ` Stefan Berger 2016-03-10 14:15 ` Jarkko Sakkinen 2016-03-10 16:39 ` Jarkko Sakkinen 2016-03-10 16:39 ` Jarkko Sakkinen 2016-03-10 17:30 ` Stefan Berger 2016-03-10 17:30 ` Stefan Berger 2016-03-11 9:50 ` Jarkko Sakkinen 2016-03-10 17:32 ` Stefan Berger 2016-03-10 17:32 ` Stefan Berger 2016-03-11 10:20 ` Jarkko Sakkinen 2016-03-11 10:20 ` Jarkko Sakkinen 2016-03-10 22:12 ` Jason Gunthorpe 2016-03-09 17:39 ` [PATCH v6 09/11] tpm: Initialize TPM and get durations and timeouts Stefan Berger 2016-03-09 17:39 ` Stefan Berger 2016-03-09 17:39 ` Stefan Berger [this message] 2016-03-09 17:39 ` [PATCH v6 10/11] tpm: Add documentation for the tpm_vtpm device driver Stefan Berger
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1457545170-30120-11-git-send-email-stefanb@linux.vnet.ibm.com \ --to=stefanb@linux.vnet.ibm.com \ --cc=jarkko.sakkinen@linux.intel.com \ --cc=jgunthorpe@obsidianresearch.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=tpmdd-devel@lists.sourceforge.net \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.