* [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine
@ 2014-12-31 4:44 Quan Xu
2015-01-05 13:18 ` Wei Liu
2015-01-05 13:20 ` Ian Campbell
0 siblings, 2 replies; 6+ messages in thread
From: Quan Xu @ 2014-12-31 4:44 UTC (permalink / raw)
To: xen-devel
Cc: wei.liu2, ian.campbell, stefano.stabellini, ian.jackson, Quan Xu,
samuel.thibault, dgdegra
This patch series are only the Xen part to enable stubdom vTPM for HVM virtual machine.
it will work w/ Qemu patch series and seaBios patch series. Change QEMU_STUBDOM_VTPM compile
option from 'n' to 'y', when the Qemu/SeaBios patch series are merged.
========================
*INTRODUCTION*
========================
The goal of virtual Trusted Platform Module (vTPM) is to provide a TPM functionality to virtual
machines (Fedora, Ubuntu, Redhat, Windows .etc). This allows programs to interact with a TPM in
a virtual machine the same way they interact with a TPM on the physical system. Each virtual
machine gets its own unique, emulated, software TPM. Each major component of vTPM is implemented
as a stubdom, providing secure separation guaranteed by the hypervisor.
The vTPM stubdom is a Xen mini-OS domain that emulates a TPM for the virtual machine to use. It
is a small wrapper around the Berlios TPM emulator. TPM commands are passed from mini-os TPM
backend driver.
========================
*ARCHITECTURE*
========================
The architecture of stubdom vTPM for HVM virtual machine:
+--------------------+
| Windows/Linux DomU | ...
| | ^ |
| v | |
| Qemu tpm1.2 Tis |
| | ^ |
| v | |
| XenStubdoms backend|
+--------------------+
| ^
v |
+--------------------+
| XenDevOps |
+--------------------+
| ^
v |
+--------------------+
| mini-os/tpmback |
| | ^ |
| v | |
| vtpm-stubdom | ...
| | ^ |
| v | |
| mini-os/tpmfront |
+--------------------+
| ^
v |
+--------------------+
| mini-os/tpmback |
| | ^ |
| v | |
| vtpmmgr-stubdom |
| | ^ |
| v | |
| mini-os/tpm_tis |
+--------------------+
| ^
v |
+--------------------+
| Hardware TPM |
+--------------------+
* Windows/Linux DomU:
The HVM based guest that wants to use a vTPM. There may be
more than one of these.
* Qemu tpm1.2 Tis:
Implementation of the tpm1.2 Tis interface for HVM virtual
machines. It is Qemu emulation device.
* vTPM xenstubdoms driver:
Qemu vTPM driver. This driver provides vtpm initialization
and sending data and commends to a para-virtualized vtpm
stubdom.
* XenDevOps:
Register Xen stubdom vTPM frontend driver, and transfer any
request/repond between TPM xenstubdoms driver and Xen vTPM
stubdom. Facilitate communications between Xen vTPM stubdom
and vTPM xenstubdoms driver.
* mini-os/tpmback:
Mini-os TPM backend driver. The Linux frontend driver connects
to this backend driver to facilitate communications between the
Linux DomU and its vTPM. This driver is also used by vtpmmgr
stubdom to communicate with vtpm-stubdom.
* vtpm-stubdom:
A mini-os stub domain that implements a vTPM. There is a
one to one mapping between running vtpm-stubdom instances and
logical vtpms on the system. The vTPM Platform Configuration
Registers (PCRs) are all initialized to zero.
* mini-os/tpmfront:
Mini-os TPM frontend driver. The vTPM mini-os domain vtpm
stubdom uses this driver to communicate with vtpmmgr-stubdom.
This driver could also be used separately to implement a mini-os
domain that wishes to use a vTPM of its own.
* vtpmmgr-stubdom:
A mini-os domain that implements the vTPM manager. There is only
one vTPM manager and it should be running during the entire lifetime
of the machine. vtpmmgr domain securely stores encryption keys for
each of the vtpms and accesses to the hardware TPM to get the root of
trust for the entire system.
* mini-os/tpm_tis:
Mini-os TPM version 1.2 TPM Interface Specification (TIS) driver.
This driver used by vtpmmgr-stubdom to talk directly to the hardware
TPM. Communication is facilitated by mapping hardware memory pages
into vtpmmgr stubdom.
* Hardware TPM: The physical TPM 1.2 that is soldered onto the motherboard.
========================
*BUILD & TEST*
========================
The following steps are how to build and test it:
1. SeaBios with my patch against upstream seabios is not submitted. I will
submit seabios patch later. Now I archive my seabios patch against upstream
seabios in Github: https://github.com/virt2x/seabios2 , try to build it for
test.
Configure it with Xen,
--- <Xen> Config.mk
-SEABIOS_UPSTREAM_URL ?= git://xenbits.xen.org/seabios.git
+SEABIOS_UPSTREAM_URL ?= https://github.com/virt2x/seabios2
[...]
-SEABIOS_UPSTREAM_REVISION ?= rel-1.7.5
+SEABIOS_UPSTREAM_REVISION ?= ea94c083cc15875f46f0bf288b6531154b866f5a
2. QEMU with my patch against upstream QEMU is
'[PATCH v3 0/5] QEMU:Xen stubdom vTPM for HVM virtual machine'.
I archive my QEMU patch series again Upstream QEMU in github:
https://github.com/virt2x/qemu-xen-unstable2
Configure it with Xen,
--- <Xen> Config.mk
-QEMU_UPSTREAM_URL ?= git://xenbits.xen.org/qemu-upstream-unstable.git
+QEMU_UPSTREAM_URL ?= https://github.com/virt2x/qemu-xen-unstable2
-QEMU_UPSTREAM_REVISION ?= qemu-xen-4.5.0-rc1
+QEMU_UPSTREAM_REVISION ?= 25694232b64104fd4fa2b8086f790b156a970e1e
3. build/install Xen
Change QEMU_STUBDOM_VTPM option from 'n' to 'y'
QEMU_STUBDOM_VTPM ?= y
./configure --prefix=/usr
make dist
make install
4. try to launch vtpmmgr / vtpm domain via <Xen>/docs/misc/vtpm-platforms.txt.
The reader is assumed to have familiarity with building and installing Xen, Linux,
and a basic understanding of the TPM and vTPM concepts.
The Linux / Windows HVM guest configuration file needs to be modified to include the
following line:
[..]
vtpm=["backend=domu-vtpm"]
device_model_version = 'qemu-xen'
acpi = 1
[..]
#(domu-vtpm is the name vtpm domain, A mini-os stub domain that implements a vTPM)
5. enable native TPM 1.2 drvier in HVM virtual machine. for example enable tpm_tis.ko
in Linux HVM virtual machine.
If you have trousers and tpm_tools installed on the guest, the tpm_version command should
return the following:
The version command should return the following:
TPM 1.2 Version Info:
Chip Version: 1.2.0.7
Spec Level: 2
Errata Revision: 1
TPM Vendor ID: ETHZ
TPM Version: 01010000
Manufacturer Info: 4554485a
Or check it with sysfs, /sys/class/misc/tpm0
--Changes in v2:
-Delete HVM_PARAM_STUBDOM_VTPM parameter, QEMU Reads Xen vTPM status via XenStore.
Quan Xu (5):
vTPM: event channel bind interdomain with para/hvm virtual machine
vTPM: limit libxl__add_vtpms() function to para virtual machine
vTPM: add TPM TCPA and SSDT for HVM virtual machine when vTPM is added
vTPM: add vTPM device for HVM virtual machine
vTPM: add QEMU_STUBDOM_VTPM compile option
Config.mk | 4 +++
extras/mini-os/include/tpmback.h | 3 ++
extras/mini-os/tpmback.c | 20 +++++++++--
tools/Makefile | 7 ++++
tools/firmware/hvmloader/acpi/build.c | 5 +--
tools/libxl/libxl.c | 62 +++++++++++++++++++++++++++++++++++
tools/libxl/libxl_create.c | 16 +++++++--
tools/libxl/libxl_dm.c | 16 +++++++++
tools/libxl/libxl_internal.h | 3 ++
tools/libxl/libxl_types.idl | 1 +
tools/libxl/xl_cmdimpl.c | 2 ++
11 files changed, 131 insertions(+), 8 deletions(-)
--
1.8.3.2
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine
2014-12-31 4:44 [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine Quan Xu
@ 2015-01-05 13:18 ` Wei Liu
2015-01-05 13:23 ` Ian Campbell
2015-01-06 2:33 ` Xu, Quan
2015-01-05 13:20 ` Ian Campbell
1 sibling, 2 replies; 6+ messages in thread
From: Wei Liu @ 2015-01-05 13:18 UTC (permalink / raw)
To: Quan Xu
Cc: wei.liu2, ian.campbell, stefano.stabellini, ian.jackson,
xen-devel, samuel.thibault, dgdegra
FWIW in the future please configure git to chain all your patches to one
thread. :-)
What I usually do is to
git format-patch HEAD~NNN --cover --subject-prefix='PATCH vXX'
... edit 0000-cover-letter.patch ...
git send-email --to xen-devel@ --cc XXX
All patches will be chained to 00/00 cover letter.
Wei.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine
2014-12-31 4:44 [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine Quan Xu
2015-01-05 13:18 ` Wei Liu
@ 2015-01-05 13:20 ` Ian Campbell
2015-01-06 2:49 ` Xu, Quan
1 sibling, 1 reply; 6+ messages in thread
From: Ian Campbell @ 2015-01-05 13:20 UTC (permalink / raw)
To: Quan Xu
Cc: wei.liu2, stefano.stabellini, ian.jackson, xen-devel,
samuel.thibault, dgdegra
On Tue, 2014-12-30 at 23:44 -0500, Quan Xu wrote:
Please can you arrange for you patch submissions to be correctly
threaded i.e. with all the mails containing a reference header either to
the previous patch or to the 0/N introductory patch.
Take a look at the --chainreplyto and --thread options to git
send-email. If you use --dry-run then you should see each mail has a
suitable References: header if you have got it right.
Without this I end up with N+1 unrelated email in my INBOX which are
very hard to keep straight as a series once people start commenting on a
subset.
Thanks,
Ian.
> This patch series are only the Xen part to enable stubdom vTPM for HVM virtual machine.
> it will work w/ Qemu patch series and seaBios patch series. Change QEMU_STUBDOM_VTPM compile
> option from 'n' to 'y', when the Qemu/SeaBios patch series are merged.
>
> ========================
> *INTRODUCTION*
> ========================
> The goal of virtual Trusted Platform Module (vTPM) is to provide a TPM functionality to virtual
> machines (Fedora, Ubuntu, Redhat, Windows .etc). This allows programs to interact with a TPM in
> a virtual machine the same way they interact with a TPM on the physical system. Each virtual
> machine gets its own unique, emulated, software TPM. Each major component of vTPM is implemented
> as a stubdom, providing secure separation guaranteed by the hypervisor.
>
> The vTPM stubdom is a Xen mini-OS domain that emulates a TPM for the virtual machine to use. It
> is a small wrapper around the Berlios TPM emulator. TPM commands are passed from mini-os TPM
> backend driver.
>
> ========================
> *ARCHITECTURE*
> ========================
> The architecture of stubdom vTPM for HVM virtual machine:
>
> +--------------------+
> | Windows/Linux DomU | ...
> | | ^ |
> | v | |
> | Qemu tpm1.2 Tis |
> | | ^ |
> | v | |
> | XenStubdoms backend|
> +--------------------+
> | ^
> v |
> +--------------------+
> | XenDevOps |
> +--------------------+
> | ^
> v |
> +--------------------+
> | mini-os/tpmback |
> | | ^ |
> | v | |
> | vtpm-stubdom | ...
> | | ^ |
> | v | |
> | mini-os/tpmfront |
> +--------------------+
> | ^
> v |
> +--------------------+
> | mini-os/tpmback |
> | | ^ |
> | v | |
> | vtpmmgr-stubdom |
> | | ^ |
> | v | |
> | mini-os/tpm_tis |
> +--------------------+
> | ^
> v |
> +--------------------+
> | Hardware TPM |
> +--------------------+
>
>
>
> * Windows/Linux DomU:
> The HVM based guest that wants to use a vTPM. There may be
> more than one of these.
>
> * Qemu tpm1.2 Tis:
> Implementation of the tpm1.2 Tis interface for HVM virtual
> machines. It is Qemu emulation device.
>
> * vTPM xenstubdoms driver:
> Qemu vTPM driver. This driver provides vtpm initialization
> and sending data and commends to a para-virtualized vtpm
> stubdom.
>
> * XenDevOps:
> Register Xen stubdom vTPM frontend driver, and transfer any
> request/repond between TPM xenstubdoms driver and Xen vTPM
> stubdom. Facilitate communications between Xen vTPM stubdom
> and vTPM xenstubdoms driver.
>
> * mini-os/tpmback:
> Mini-os TPM backend driver. The Linux frontend driver connects
> to this backend driver to facilitate communications between the
> Linux DomU and its vTPM. This driver is also used by vtpmmgr
> stubdom to communicate with vtpm-stubdom.
>
> * vtpm-stubdom:
> A mini-os stub domain that implements a vTPM. There is a
> one to one mapping between running vtpm-stubdom instances and
> logical vtpms on the system. The vTPM Platform Configuration
> Registers (PCRs) are all initialized to zero.
>
> * mini-os/tpmfront:
> Mini-os TPM frontend driver. The vTPM mini-os domain vtpm
> stubdom uses this driver to communicate with vtpmmgr-stubdom.
> This driver could also be used separately to implement a mini-os
> domain that wishes to use a vTPM of its own.
>
> * vtpmmgr-stubdom:
> A mini-os domain that implements the vTPM manager. There is only
> one vTPM manager and it should be running during the entire lifetime
> of the machine. vtpmmgr domain securely stores encryption keys for
> each of the vtpms and accesses to the hardware TPM to get the root of
> trust for the entire system.
>
> * mini-os/tpm_tis:
> Mini-os TPM version 1.2 TPM Interface Specification (TIS) driver.
> This driver used by vtpmmgr-stubdom to talk directly to the hardware
> TPM. Communication is facilitated by mapping hardware memory pages
> into vtpmmgr stubdom.
>
> * Hardware TPM: The physical TPM 1.2 that is soldered onto the motherboard.
>
> ========================
> *BUILD & TEST*
> ========================
> The following steps are how to build and test it:
>
> 1. SeaBios with my patch against upstream seabios is not submitted. I will
> submit seabios patch later. Now I archive my seabios patch against upstream
> seabios in Github: https://github.com/virt2x/seabios2 , try to build it for
> test.
>
> Configure it with Xen,
> --- <Xen> Config.mk
> -SEABIOS_UPSTREAM_URL ?= git://xenbits.xen.org/seabios.git
> +SEABIOS_UPSTREAM_URL ?= https://github.com/virt2x/seabios2
> [...]
> -SEABIOS_UPSTREAM_REVISION ?= rel-1.7.5
> +SEABIOS_UPSTREAM_REVISION ?= ea94c083cc15875f46f0bf288b6531154b866f5a
>
> 2. QEMU with my patch against upstream QEMU is
> '[PATCH v3 0/5] QEMU:Xen stubdom vTPM for HVM virtual machine'.
> I archive my QEMU patch series again Upstream QEMU in github:
> https://github.com/virt2x/qemu-xen-unstable2
>
> Configure it with Xen,
> --- <Xen> Config.mk
>
> -QEMU_UPSTREAM_URL ?= git://xenbits.xen.org/qemu-upstream-unstable.git
> +QEMU_UPSTREAM_URL ?= https://github.com/virt2x/qemu-xen-unstable2
> -QEMU_UPSTREAM_REVISION ?= qemu-xen-4.5.0-rc1
> +QEMU_UPSTREAM_REVISION ?= 25694232b64104fd4fa2b8086f790b156a970e1e
>
> 3. build/install Xen
> Change QEMU_STUBDOM_VTPM option from 'n' to 'y'
> QEMU_STUBDOM_VTPM ?= y
>
> ./configure --prefix=/usr
> make dist
> make install
>
> 4. try to launch vtpmmgr / vtpm domain via <Xen>/docs/misc/vtpm-platforms.txt.
> The reader is assumed to have familiarity with building and installing Xen, Linux,
> and a basic understanding of the TPM and vTPM concepts.
>
> The Linux / Windows HVM guest configuration file needs to be modified to include the
> following line:
>
> [..]
> vtpm=["backend=domu-vtpm"]
> device_model_version = 'qemu-xen'
> acpi = 1
> [..]
>
> #(domu-vtpm is the name vtpm domain, A mini-os stub domain that implements a vTPM)
>
> 5. enable native TPM 1.2 drvier in HVM virtual machine. for example enable tpm_tis.ko
> in Linux HVM virtual machine.
> If you have trousers and tpm_tools installed on the guest, the tpm_version command should
> return the following:
>
> The version command should return the following:
> TPM 1.2 Version Info:
> Chip Version: 1.2.0.7
> Spec Level: 2
> Errata Revision: 1
> TPM Vendor ID: ETHZ
> TPM Version: 01010000
> Manufacturer Info: 4554485a
>
> Or check it with sysfs, /sys/class/misc/tpm0
>
>
> --Changes in v2:
> -Delete HVM_PARAM_STUBDOM_VTPM parameter, QEMU Reads Xen vTPM status via XenStore.
>
>
>
> Quan Xu (5):
> vTPM: event channel bind interdomain with para/hvm virtual machine
> vTPM: limit libxl__add_vtpms() function to para virtual machine
> vTPM: add TPM TCPA and SSDT for HVM virtual machine when vTPM is added
> vTPM: add vTPM device for HVM virtual machine
> vTPM: add QEMU_STUBDOM_VTPM compile option
>
> Config.mk | 4 +++
> extras/mini-os/include/tpmback.h | 3 ++
> extras/mini-os/tpmback.c | 20 +++++++++--
> tools/Makefile | 7 ++++
> tools/firmware/hvmloader/acpi/build.c | 5 +--
> tools/libxl/libxl.c | 62 +++++++++++++++++++++++++++++++++++
> tools/libxl/libxl_create.c | 16 +++++++--
> tools/libxl/libxl_dm.c | 16 +++++++++
> tools/libxl/libxl_internal.h | 3 ++
> tools/libxl/libxl_types.idl | 1 +
> tools/libxl/xl_cmdimpl.c | 2 ++
> 11 files changed, 131 insertions(+), 8 deletions(-)
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine
2015-01-05 13:18 ` Wei Liu
@ 2015-01-05 13:23 ` Ian Campbell
2015-01-06 2:33 ` Xu, Quan
1 sibling, 0 replies; 6+ messages in thread
From: Ian Campbell @ 2015-01-05 13:23 UTC (permalink / raw)
To: Wei Liu
Cc: stefano.stabellini, ian.jackson, xen-devel, Quan Xu,
samuel.thibault, dgdegra
On Mon, 2015-01-05 at 13:18 +0000, Wei Liu wrote:
> FWIW in the future please configure git to chain all your patches to one
> thread. :-)
>
> What I usually do is to
>
> git format-patch HEAD~NNN --cover --subject-prefix='PATCH vXX'
> ... edit 0000-cover-letter.patch ...
> git send-email --to xen-devel@ --cc XXX
>
> All patches will be chained to 00/00 cover letter.
FWIW I author 00/NN in my regular MUA then:
git format-patch HEAD~NNN --in-reply-to='<msg-id-of-00-NN>' --subject-prefix='PATCH vXX'
But the affect is the same I think.
Ian.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine
2015-01-05 13:18 ` Wei Liu
2015-01-05 13:23 ` Ian Campbell
@ 2015-01-06 2:33 ` Xu, Quan
1 sibling, 0 replies; 6+ messages in thread
From: Xu, Quan @ 2015-01-06 2:33 UTC (permalink / raw)
To: Wei Liu
Cc: ian.campbell@citrix.com, stefano.stabellini@eu.citrix.com,
ian.jackson@eu.citrix.com, xen-devel@lists.xen.org,
samuel.thibault@ens-lyon.org, dgdegra@tycho.nsa.gov
> -----Original Message-----
> From: Wei Liu [mailto:wei.liu2@citrix.com]
> Sent: Monday, January 05, 2015 9:19 PM
> To: Xu, Quan
> Cc: xen-devel@lists.xen.org; dgdegra@tycho.nsa.gov;
> samuel.thibault@ens-lyon.org; ian.jackson@eu.citrix.com;
> stefano.stabellini@eu.citrix.com; ian.campbell@citrix.com;
> wei.liu2@citrix.com
> Subject: Re: [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual
> machine
>
> FWIW in the future please configure git to chain all your patches to one
> thread. :-)
>
> What I usually do is to
>
> git format-patch HEAD~NNN --cover --subject-prefix='PATCH vXX'
> ... edit 0000-cover-letter.patch ...
> git send-email --to xen-devel@ --cc XXX
>
> All patches will be chained to 00/00 cover letter.
>
Thanks. I tried for a lot of times, I will ask some opensource veteran to help me. I hope I can do right in next v3.
Quan
Thanks
> Wei.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine
2015-01-05 13:20 ` Ian Campbell
@ 2015-01-06 2:49 ` Xu, Quan
0 siblings, 0 replies; 6+ messages in thread
From: Xu, Quan @ 2015-01-06 2:49 UTC (permalink / raw)
To: Ian Campbell
Cc: wei.liu2@citrix.com, stefano.stabellini@eu.citrix.com,
ian.jackson@eu.citrix.com, xen-devel@lists.xen.org,
samuel.thibault@ens-lyon.org, dgdegra@tycho.nsa.gov
> -----Original Message-----
> From: Ian Campbell [mailto:Ian.Campbell@citrix.com]
> Sent: Monday, January 05, 2015 9:21 PM
> To: Xu, Quan
> Cc: xen-devel@lists.xen.org; dgdegra@tycho.nsa.gov;
> samuel.thibault@ens-lyon.org; ian.jackson@eu.citrix.com;
> stefano.stabellini@eu.citrix.com; wei.liu2@citrix.com
> Subject: Re: [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual
> machine
>
> On Tue, 2014-12-30 at 23:44 -0500, Quan Xu wrote:
>
> Please can you arrange for you patch submissions to be correctly threaded i.e.
> with all the mails containing a reference header either to the previous patch
> or to the 0/N introductory patch.
>
> Take a look at the --chainreplyto and --thread options to git send-email. If you
> use --dry-run then you should see each mail has a suitable References:
> header if you have got it right.
>
> Without this I end up with N+1 unrelated email in my INBOX which are very
> hard to keep straight as a series once people start commenting on a subset.
>
> Thanks,
> Ian.
>
Thanks. I tried for a lot of times, I will ask some opensource veteran to help me.
I really didn't understand it before you tell me.
Thanks
Quan Xu
> > This patch series are only the Xen part to enable stubdom vTPM for HVM
> virtual machine.
> > it will work w/ Qemu patch series and seaBios patch series. Change
> > QEMU_STUBDOM_VTPM compile option from 'n' to 'y', when the
> Qemu/SeaBios patch series are merged.
> >
> > ========================
> > *INTRODUCTION*
> > ========================
> > The goal of virtual Trusted Platform Module (vTPM) is to provide a TPM
> > functionality to virtual machines (Fedora, Ubuntu, Redhat, Windows
> > .etc). This allows programs to interact with a TPM in a virtual
> > machine the same way they interact with a TPM on the physical system.
> > Each virtual machine gets its own unique, emulated, software TPM. Each
> major component of vTPM is implemented as a stubdom, providing secure
> separation guaranteed by the hypervisor.
> >
> > The vTPM stubdom is a Xen mini-OS domain that emulates a TPM for the
> > virtual machine to use. It is a small wrapper around the Berlios TPM
> > emulator. TPM commands are passed from mini-os TPM backend driver.
> >
> > ========================
> > *ARCHITECTURE*
> > ========================
> > The architecture of stubdom vTPM for HVM virtual machine:
> >
> > +--------------------+
> > | Windows/Linux DomU | ...
> > | | ^ |
> > | v | |
> > | Qemu tpm1.2 Tis |
> > | | ^ |
> > | v | |
> > | XenStubdoms backend|
> > +--------------------+
> > | ^
> > v |
> > +--------------------+
> > | XenDevOps |
> > +--------------------+
> > | ^
> > v |
> > +--------------------+
> > | mini-os/tpmback |
> > | | ^ |
> > | v | |
> > | vtpm-stubdom | ...
> > | | ^ |
> > | v | |
> > | mini-os/tpmfront |
> > +--------------------+
> > | ^
> > v |
> > +--------------------+
> > | mini-os/tpmback |
> > | | ^ |
> > | v | |
> > | vtpmmgr-stubdom |
> > | | ^ |
> > | v | |
> > | mini-os/tpm_tis |
> > +--------------------+
> > | ^
> > v |
> > +--------------------+
> > | Hardware TPM |
> > +--------------------+
> >
> >
> >
> > * Windows/Linux DomU:
> > The HVM based guest that wants to use a vTPM. There may be
> > more than one of these.
> >
> > * Qemu tpm1.2 Tis:
> > Implementation of the tpm1.2 Tis interface for HVM virtual
> > machines. It is Qemu emulation device.
> >
> > * vTPM xenstubdoms driver:
> > Qemu vTPM driver. This driver provides vtpm initialization
> > and sending data and commends to a para-virtualized vtpm
> > stubdom.
> >
> > * XenDevOps:
> > Register Xen stubdom vTPM frontend driver, and transfer any
> > request/repond between TPM xenstubdoms driver and Xen vTPM
> > stubdom. Facilitate communications between Xen vTPM stubdom
> > and vTPM xenstubdoms driver.
> >
> > * mini-os/tpmback:
> > Mini-os TPM backend driver. The Linux frontend driver connects
> > to this backend driver to facilitate communications between the
> > Linux DomU and its vTPM. This driver is also used by vtpmmgr
> > stubdom to communicate with vtpm-stubdom.
> >
> > * vtpm-stubdom:
> > A mini-os stub domain that implements a vTPM. There is a
> > one to one mapping between running vtpm-stubdom instances and
> > logical vtpms on the system. The vTPM Platform Configuration
> > Registers (PCRs) are all initialized to zero.
> >
> > * mini-os/tpmfront:
> > Mini-os TPM frontend driver. The vTPM mini-os domain vtpm
> > stubdom uses this driver to communicate with vtpmmgr-stubdom.
> > This driver could also be used separately to implement a mini-os
> > domain that wishes to use a vTPM of its own.
> >
> > * vtpmmgr-stubdom:
> > A mini-os domain that implements the vTPM manager. There is only
> > one vTPM manager and it should be running during the entire lifetime
> > of the machine. vtpmmgr domain securely stores encryption keys for
> > each of the vtpms and accesses to the hardware TPM to get the root
> of
> > trust for the entire system.
> >
> > * mini-os/tpm_tis:
> > Mini-os TPM version 1.2 TPM Interface Specification (TIS) driver.
> > This driver used by vtpmmgr-stubdom to talk directly to the hardware
> > TPM. Communication is facilitated by mapping hardware memory
> pages
> > into vtpmmgr stubdom.
> >
> > * Hardware TPM: The physical TPM 1.2 that is soldered onto the
> motherboard.
> >
> > ========================
> > *BUILD & TEST*
> > ========================
> > The following steps are how to build and test it:
> >
> > 1. SeaBios with my patch against upstream seabios is not submitted. I
> > will submit seabios patch later. Now I archive my seabios patch
> > against upstream seabios in Github: https://github.com/virt2x/seabios2
> > , try to build it for test.
> >
> > Configure it with Xen,
> > --- <Xen> Config.mk
> > -SEABIOS_UPSTREAM_URL ?= git://xenbits.xen.org/seabios.git
> > +SEABIOS_UPSTREAM_URL ?= https://github.com/virt2x/seabios2
> > [...]
> > -SEABIOS_UPSTREAM_REVISION ?= rel-1.7.5
> > +SEABIOS_UPSTREAM_REVISION ?=
> > ea94c083cc15875f46f0bf288b6531154b866f5a
> >
> > 2. QEMU with my patch against upstream QEMU is
> > '[PATCH v3 0/5] QEMU:Xen stubdom vTPM for HVM virtual machine'.
> > I archive my QEMU patch series again Upstream QEMU in github:
> > https://github.com/virt2x/qemu-xen-unstable2
> >
> > Configure it with Xen,
> > --- <Xen> Config.mk
> >
> > -QEMU_UPSTREAM_URL ?=
> git://xenbits.xen.org/qemu-upstream-unstable.git
> > +QEMU_UPSTREAM_URL ?=
> https://github.com/virt2x/qemu-xen-unstable2
> > -QEMU_UPSTREAM_REVISION ?= qemu-xen-4.5.0-rc1
> > +QEMU_UPSTREAM_REVISION ?=
> > 25694232b64104fd4fa2b8086f790b156a970e1e
> >
> > 3. build/install Xen
> > Change QEMU_STUBDOM_VTPM option from 'n' to 'y'
> > QEMU_STUBDOM_VTPM ?= y
> >
> > ./configure --prefix=/usr
> > make dist
> > make install
> >
> > 4. try to launch vtpmmgr / vtpm domain via
> <Xen>/docs/misc/vtpm-platforms.txt.
> > The reader is assumed to have familiarity with building and installing
> > Xen, Linux, and a basic understanding of the TPM and vTPM concepts.
> >
> > The Linux / Windows HVM guest configuration file needs to be modified
> > to include the following line:
> >
> > [..]
> > vtpm=["backend=domu-vtpm"]
> > device_model_version = 'qemu-xen'
> > acpi = 1
> > [..]
> >
> > #(domu-vtpm is the name vtpm domain, A mini-os stub domain that
> > implements a vTPM)
> >
> > 5. enable native TPM 1.2 drvier in HVM virtual machine. for example
> > enable tpm_tis.ko in Linux HVM virtual machine.
> > If you have trousers and tpm_tools installed on the guest, the
> > tpm_version command should return the following:
> >
> > The version command should return the following:
> > TPM 1.2 Version Info:
> > Chip Version: 1.2.0.7
> > Spec Level: 2
> > Errata Revision: 1
> > TPM Vendor ID: ETHZ
> > TPM Version: 01010000
> > Manufacturer Info: 4554485a
> >
> > Or check it with sysfs, /sys/class/misc/tpm0
> >
> >
> > --Changes in v2:
> > -Delete HVM_PARAM_STUBDOM_VTPM parameter, QEMU Reads Xen
> vTPM status via XenStore.
> >
> >
> >
> > Quan Xu (5):
> > vTPM: event channel bind interdomain with para/hvm virtual machine
> > vTPM: limit libxl__add_vtpms() function to para virtual machine
> > vTPM: add TPM TCPA and SSDT for HVM virtual machine when vTPM is
> added
> > vTPM: add vTPM device for HVM virtual machine
> > vTPM: add QEMU_STUBDOM_VTPM compile option
> >
> > Config.mk | 4 +++
> > extras/mini-os/include/tpmback.h | 3 ++
> > extras/mini-os/tpmback.c | 20 +++++++++--
> > tools/Makefile | 7 ++++
> > tools/firmware/hvmloader/acpi/build.c | 5 +--
> > tools/libxl/libxl.c | 62
> +++++++++++++++++++++++++++++++++++
> > tools/libxl/libxl_create.c | 16 +++++++--
> > tools/libxl/libxl_dm.c | 16 +++++++++
> > tools/libxl/libxl_internal.h | 3 ++
> > tools/libxl/libxl_types.idl | 1 +
> > tools/libxl/xl_cmdimpl.c | 2 ++
> > 11 files changed, 131 insertions(+), 8 deletions(-)
> >
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-01-06 2:49 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-31 4:44 [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine Quan Xu
2015-01-05 13:18 ` Wei Liu
2015-01-05 13:23 ` Ian Campbell
2015-01-06 2:33 ` Xu, Quan
2015-01-05 13:20 ` Ian Campbell
2015-01-06 2:49 ` Xu, Quan
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.