[Xen-devel] [PATCH v2 0/5] vTPM: Xen stubdom vTPM for HVM virtual machine

[Quan Xu <quan.xu@xxxxxxxxx>]

This patch series are only the Xen part to enable stubdom vTPM for HVM virtual 
machine.
it will work w/ Qemu patch series and seaBios patch series. Change 
QEMU_STUBDOM_VTPM compile
option from 'n' to 'y', when the Qemu/SeaBios patch series are merged.

========================
    *INTRODUCTION*
========================
The goal of virtual Trusted Platform Module (vTPM) is to provide a TPM 
functionality to virtual 
machines (Fedora, Ubuntu, Redhat, Windows .etc). This allows programs to 
interact with a TPM in 
a virtual machine the same way they interact with a TPM on the physical system. 
Each virtual 
machine gets its own unique, emulated, software TPM. Each major component of 
vTPM is implemented 
as a stubdom, providing secure separation guaranteed by the hypervisor.

The vTPM stubdom is a Xen mini-OS domain that emulates a TPM for the virtual 
machine to use. It 
is a small wrapper around the Berlios TPM emulator. TPM commands are passed 
from mini-os TPM 
backend driver.

========================
     *ARCHITECTURE*
========================
The architecture of stubdom vTPM for HVM virtual machine:

            +--------------------+
            | Windows/Linux DomU | ...
            |        |  ^        |
            |        v  |        |
            |  Qemu tpm1.2 Tis   |
            |        |  ^        |
            |        v  |        |
            | XenStubdoms backend|
            +--------------------+
                     |  ^
                     v  |
            +--------------------+
            |      XenDevOps     |
            +--------------------+
                     |  ^
                     v  |
            +--------------------+
            |  mini-os/tpmback   |
            |        |  ^        |
            |        v  |        |
            |   vtpm-stubdom     | ...
            |        |  ^        |
            |        v  |        |
            |  mini-os/tpmfront  |
            +--------------------+
                     |  ^
                     v  |
            +--------------------+
            |  mini-os/tpmback   |
            |        |  ^        |
            |        v  |        |
            |  vtpmmgr-stubdom   |
            |        |  ^        |
            |        v  |        |
            |  mini-os/tpm_tis   |
            +--------------------+
                     |  ^
                     v  |
            +--------------------+
            |    Hardware TPM    |
            +--------------------+



 * Windows/Linux DomU:
    The HVM based guest that wants to use a vTPM. There may be
    more than one of these.

 * Qemu tpm1.2 Tis:
    Implementation of the tpm1.2 Tis interface for HVM virtual
    machines. It is Qemu emulation device.

 * vTPM xenstubdoms driver:
    Qemu vTPM driver. This driver provides vtpm initialization
    and sending data and commends to a para-virtualized vtpm
    stubdom.

 * XenDevOps:
    Register Xen stubdom vTPM frontend driver, and transfer any
    request/repond between TPM xenstubdoms driver and Xen vTPM
    stubdom. Facilitate communications between Xen vTPM stubdom
    and vTPM xenstubdoms driver.

 * mini-os/tpmback:
    Mini-os TPM backend driver. The Linux frontend driver connects
    to this backend driver to facilitate communications between the
    Linux DomU and its vTPM. This driver is also used by vtpmmgr
    stubdom to communicate with vtpm-stubdom.

 * vtpm-stubdom:
    A mini-os stub domain that implements a vTPM. There is a
    one to one mapping between running vtpm-stubdom instances and
    logical vtpms on the system. The vTPM Platform Configuration
    Registers (PCRs) are all initialized to zero.

 * mini-os/tpmfront:
    Mini-os TPM frontend driver. The vTPM mini-os domain vtpm
    stubdom uses this driver to communicate with vtpmmgr-stubdom.
    This driver could also be used separately to implement a mini-os
    domain that wishes to use a vTPM of its own.

 * vtpmmgr-stubdom:
    A mini-os domain that implements the vTPM manager. There is only
    one vTPM manager and it should be running during the entire lifetime
    of the machine. vtpmmgr domain securely stores encryption keys for
    each of the vtpms and accesses to the hardware TPM to get the root of
    trust for the entire system.

 * mini-os/tpm_tis:
    Mini-os TPM version 1.2 TPM Interface Specification (TIS) driver.
    This driver used by vtpmmgr-stubdom to talk directly to the hardware
    TPM. Communication is facilitated by mapping hardware memory pages
    into vtpmmgr stubdom.

 * Hardware TPM: The physical TPM 1.2 that is soldered onto the motherboard.

========================
    *BUILD & TEST*
========================
The following steps are how to build and test it: 

1. SeaBios with my patch against upstream seabios is not submitted. I will
submit seabios patch later. Now I archive my seabios patch against upstream
seabios in Github: https://github.com/virt2x/seabios2 , try to build it for
test. 

Configure it with Xen,
--- <Xen> Config.mk
    -SEABIOS_UPSTREAM_URL ?= git://xenbits.xen.org/seabios.git
    +SEABIOS_UPSTREAM_URL ?= https://github.com/virt2x/seabios2
    [...]
    -SEABIOS_UPSTREAM_REVISION ?= rel-1.7.5
    +SEABIOS_UPSTREAM_REVISION ?= ea94c083cc15875f46f0bf288b6531154b866f5a

2. QEMU with my patch against upstream QEMU is 
    '[PATCH v3 0/5] QEMU:Xen stubdom vTPM for HVM virtual machine'.
I archive my QEMU patch series again Upstream QEMU in github:
    https://github.com/virt2x/qemu-xen-unstable2 

Configure it with Xen, 
--- <Xen> Config.mk

    -QEMU_UPSTREAM_URL ?= git://xenbits.xen.org/qemu-upstream-unstable.git
    +QEMU_UPSTREAM_URL ?= https://github.com/virt2x/qemu-xen-unstable2
    -QEMU_UPSTREAM_REVISION ?= qemu-xen-4.5.0-rc1
    +QEMU_UPSTREAM_REVISION ?= 25694232b64104fd4fa2b8086f790b156a970e1e

3. build/install Xen
Change QEMU_STUBDOM_VTPM option from 'n' to 'y'
    QEMU_STUBDOM_VTPM ?= y

./configure --prefix=/usr
make dist
make install 

4. try to launch vtpmmgr / vtpm domain via <Xen>/docs/misc/vtpm-platforms.txt.
The reader is assumed to have familiarity with building and installing Xen, 
Linux,
and a basic understanding of the TPM and vTPM concepts.

The Linux / Windows HVM guest configuration file needs to be modified to 
include the
following line:

    [..]
    vtpm=["backend=domu-vtpm"]
    device_model_version = 'qemu-xen'
    acpi = 1
    [..]

#(domu-vtpm is the name vtpm domain, A mini-os stub domain that implements a 
vTPM)

5. enable native TPM 1.2 drvier in HVM virtual machine. for example enable 
tpm_tis.ko
in Linux HVM virtual machine. 
If you have trousers and tpm_tools installed on the guest, the tpm_version 
command should
return the following:

The version command should return the following:
  TPM 1.2 Version Info:
  Chip Version:        1.2.0.7
  Spec Level:          2
  Errata Revision:     1
  TPM Vendor ID:       ETHZ
  TPM Version:         01010000
  Manufacturer Info:   4554485a

Or check it with sysfs, /sys/class/misc/tpm0


--Changes in v2:
  -Delete HVM_PARAM_STUBDOM_VTPM parameter, QEMU Reads Xen vTPM status via 
XenStore.



Quan Xu (5):
  vTPM: event channel bind interdomain with para/hvm virtual machine
  vTPM: limit libxl__add_vtpms() function to para virtual machine
  vTPM: add TPM TCPA and SSDT for HVM virtual machine when vTPM is added
  vTPM: add vTPM device for HVM virtual machine
  vTPM: add QEMU_STUBDOM_VTPM compile option

 Config.mk                             |  4 +++
 extras/mini-os/include/tpmback.h      |  3 ++
 extras/mini-os/tpmback.c              | 20 +++++++++--
 tools/Makefile                        |  7 ++++
 tools/firmware/hvmloader/acpi/build.c |  5 +--
 tools/libxl/libxl.c                   | 62 +++++++++++++++++++++++++++++++++++
 tools/libxl/libxl_create.c            | 16 +++++++--
 tools/libxl/libxl_dm.c                | 16 +++++++++
 tools/libxl/libxl_internal.h          |  3 ++
 tools/libxl/libxl_types.idl           |  1 +
 tools/libxl/xl_cmdimpl.c              |  2 ++
 11 files changed, 131 insertions(+), 8 deletions(-)

-- 
1.8.3.2


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel