1 | Copyright: IBM Corporation (C), Intel Corporation |
---|
2 | 29 June 2006 |
---|
3 | Authors: Stefan Berger <stefanb@us.ibm.com> (IBM), |
---|
4 | Employees of Intel Corp |
---|
5 | |
---|
6 | This document gives a short introduction to the virtual TPM support |
---|
7 | in XEN and goes as far as connecting a user domain to a virtual TPM |
---|
8 | instance and doing a short test to verify success. It is assumed |
---|
9 | that the user is fairly familiar with compiling and installing XEN |
---|
10 | and Linux on a machine. |
---|
11 | |
---|
12 | Production Prerequisites: An x86-based machine machine with a |
---|
13 | Linux-supported TPM on the motherboard (NSC, Atmel, Infineon, TPM V1.2). |
---|
14 | Development Prerequisites: An emulator for TESTING ONLY is provided |
---|
15 | |
---|
16 | |
---|
17 | Compiling the XEN tree: |
---|
18 | ----------------------- |
---|
19 | |
---|
20 | Compile the XEN tree as usual after the following lines set in the |
---|
21 | linux-2.6.??-xen/.config file: |
---|
22 | |
---|
23 | CONFIG_XEN_TPMDEV_BACKEND=m |
---|
24 | |
---|
25 | CONFIG_TCG_TPM=m |
---|
26 | CONFIG_TCG_TIS=m (supported after 2.6.17-rc4) |
---|
27 | CONFIG_TCG_NSC=m |
---|
28 | CONFIG_TCG_ATMEL=m |
---|
29 | CONFIG_TCG_INFINEON=m |
---|
30 | CONFIG_TCG_XEN=m |
---|
31 | <possible other TPM drivers supported by Linux> |
---|
32 | |
---|
33 | If the frontend driver needs to be compiled into the user domain |
---|
34 | kernel, then the following two lines should be changed. |
---|
35 | |
---|
36 | CONFIG_TCG_TPM=y |
---|
37 | CONFIG_TCG_XEN=y |
---|
38 | |
---|
39 | |
---|
40 | You must also enable the virtual TPM to be built: |
---|
41 | |
---|
42 | In Config.mk in the Xen root directory set the line |
---|
43 | |
---|
44 | VTPM_TOOLS ?= y |
---|
45 | |
---|
46 | and in |
---|
47 | |
---|
48 | tools/vtpm/Rules.mk set the line |
---|
49 | |
---|
50 | BUILD_EMULATOR = y |
---|
51 | |
---|
52 | Now build the Xen sources from Xen's root directory: |
---|
53 | |
---|
54 | make install |
---|
55 | |
---|
56 | |
---|
57 | Also build the initial RAM disk if necessary. |
---|
58 | |
---|
59 | Reboot the machine with the created Xen kernel. |
---|
60 | |
---|
61 | Note: If you do not want any TPM-related code compiled into your |
---|
62 | kernel or built as module then comment all the above lines like |
---|
63 | this example: |
---|
64 | # CONFIG_TCG_TPM is not set |
---|
65 | |
---|
66 | |
---|
67 | Modifying VM Configuration files: |
---|
68 | --------------------------------- |
---|
69 | |
---|
70 | VM configuration files need to be adapted to make a TPM instance |
---|
71 | available to a user domain. The following VM configuration file is |
---|
72 | an example of how a user domain can be configured to have a TPM |
---|
73 | available. It works similar to making a network interface |
---|
74 | available to a domain. |
---|
75 | |
---|
76 | kernel = "/boot/vmlinuz-2.6.x" |
---|
77 | ramdisk = "/xen/initrd_domU/U1_ramdisk.img" |
---|
78 | memory = 32 |
---|
79 | name = "TPMUserDomain0" |
---|
80 | vtpm = ['instance=1,backend=0'] |
---|
81 | root = "/dev/ram0 cosole=tty ro" |
---|
82 | vif = ['backend=0'] |
---|
83 | |
---|
84 | In the above configuration file the line 'vtpm = ...' provides |
---|
85 | information about the domain where the virtual TPM is running and |
---|
86 | where the TPM backend has been compiled into - this has to be |
---|
87 | domain 0 at the moment - and which TPM instance the user domain |
---|
88 | is supposed to talk to. Note that each running VM must use a |
---|
89 | different instance and that using instance 0 is NOT allowed. The |
---|
90 | instance parameter is taken as the desired instance number, but |
---|
91 | the actual instance number that is assigned to the virtual machine |
---|
92 | can be different. This is the case if for example that particular |
---|
93 | instance is already used by another virtual machine. The association |
---|
94 | of which TPM instance number is used by which virtual machine is |
---|
95 | kept in the file /etc/xen/vtpm.db. Associations are maintained by |
---|
96 | domain name and instance number. |
---|
97 | |
---|
98 | Note: If you do not want TPM functionality for your user domain simply |
---|
99 | leave out the 'vtpm' line in the configuration file. |
---|
100 | |
---|
101 | |
---|
102 | Running the TPM: |
---|
103 | ---------------- |
---|
104 | |
---|
105 | To run the vTPM, the device /dev/vtpm must be available. |
---|
106 | Verify that 'ls -l /dev/vtpm' shows the following output: |
---|
107 | |
---|
108 | crw------- 1 root root 10, 225 Aug 11 06:58 /dev/vtpm |
---|
109 | |
---|
110 | If it is not available, run the following command as 'root'. |
---|
111 | mknod /dev/vtpm c 10 225 |
---|
112 | |
---|
113 | Make sure that the vTPM is running in domain 0. To do this run the |
---|
114 | following: |
---|
115 | |
---|
116 | modprobe tpmbk |
---|
117 | |
---|
118 | /usr/bin/vtpm_managerd |
---|
119 | |
---|
120 | Start a user domain using the 'xm create' command. Once you are in the |
---|
121 | shell of the user domain, you should be able to do the following as |
---|
122 | user 'root': |
---|
123 | |
---|
124 | Insert the TPM frontend into the kernel if it has been compiled as a |
---|
125 | kernel module. |
---|
126 | |
---|
127 | > modprobe tpm_xenu |
---|
128 | |
---|
129 | Check the status of the TPM |
---|
130 | |
---|
131 | > cd /sys/devices/xen/vtpm-0 |
---|
132 | > ls |
---|
133 | [...] cancel caps pcrs pubek [...] |
---|
134 | > cat pcrs |
---|
135 | PCR-00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
136 | PCR-01: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
137 | PCR-02: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
138 | PCR-03: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
139 | PCR-04: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
140 | PCR-05: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
141 | PCR-06: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
142 | PCR-07: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
143 | PCR-08: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
---|
144 | [...] |
---|
145 | |
---|
146 | At this point the user domain has been sucessfully connected to its |
---|
147 | virtual TPM instance. |
---|
148 | |
---|
149 | For further information please read the documentation in |
---|
150 | tools/vtpm_manager/README and tools/vtpm/README |
---|
151 | |
---|
152 | Stefan Berger and Employees of the Intel Corp |
---|