51 lines · plain
1=============================================2Virtual TPM Proxy Driver for Linux Containers3=============================================4 5| Authors:6| Stefan Berger <stefanb@linux.vnet.ibm.com>7 8This document describes the virtual Trusted Platform Module (vTPM)9proxy device driver for Linux containers.10 11Introduction12============13 14The goal of this work is to provide TPM functionality to each Linux15container. This allows programs to interact with a TPM in a container16the same way they interact with a TPM on the physical system. Each17container gets its own unique, emulated, software TPM.18 19Design20======21 22To make an emulated software TPM available to each container, the container23management stack needs to create a device pair consisting of a client TPM24character device ``/dev/tpmX`` (with X=0,1,2...) and a 'server side' file25descriptor. The former is moved into the container by creating a character26device with the appropriate major and minor numbers while the file descriptor27is passed to the TPM emulator. Software inside the container can then send28TPM commands using the character device and the emulator will receive the29commands via the file descriptor and use it for sending back responses.30 31To support this, the virtual TPM proxy driver provides a device ``/dev/vtpmx``32that is used to create device pairs using an ioctl. The ioctl takes as33an input flags for configuring the device. The flags for example indicate34whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator.35The result of the ioctl are the file descriptor for the 'server side'36as well as the major and minor numbers of the character device that was created.37Besides that the number of the TPM character device is returned. If for38example ``/dev/tpm10`` was created, the number (``dev_num``) 10 is returned.39 40Once the device has been created, the driver will immediately try to talk41to the TPM. All commands from the driver can be read from the file descriptor42returned by the ioctl. The commands should be responded to immediately.43 44UAPI45====46 47.. kernel-doc:: include/uapi/linux/vtpm_proxy.h48 49.. kernel-doc:: drivers/char/tpm/tpm_vtpm_proxy.c50 :functions: vtpmx_ioc_new_dev51