| This directory hosts (v)TPM related code. |
| |
| Background: |
| ----------- |
| |
| A TPM is a crypto chip that is found in many systems. Besides it offering |
| a secure key store, among other functionality, it is also used to implement |
| 'trusted boot'. This is realized by code in the firmware measuring parts of the |
| firmware's code and data as well as system data, such as the boot block, and |
| logging these measurements and storing (extending) them in the TPM's platform |
| configuration register (PCR). |
| |
| The benefits of having a TPM (or vTPM) in a system are: |
| |
| - enablement of trusted boot; this allow us to eventually extend the chain of |
| trust from the hypervisor to the guests |
| - enablement of attestation so that one can verify what software is running on |
| a machine (OpenPTS, OpenAttestation) |
| - provides TPM functionality to VMs, which includes a standardized mechanism |
| to store keys and other blobs (Linux trusted keys, GNU TLS's TPM extensions) |
| |
| |
| QEMU/KVM + SLOF support: |
| ------------------------ |
| |
| vTPM for QEMU/KVM pSeries virtual machines is support in QEMU 5.0. |
| |
| To start a QEMU VM with an attached vTPM (swtpm), run the below shown commands. |
| The following will setup the vTPM so that its state will be stored in |
| /tmp/myvtpm1. A unique directory for each VM instance with attached vTPM |
| must be provided. Whenever QEMU is started, the swtpm has to be started |
| before it. The file 'boot_rom.bin' is SLOF with vTPM extensions built-in. |
| |
| #> mkdir -p /tmp/mytpm1 |
| #> swtpm socket --tpm2 --tpmstate dir=/tmp/mytpm1 \ |
| --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock |
| |
| In another terminal: |
| |
| #> sudo qemu-system-ppc64 -display sdl \ |
| -machine pseries,accel=kvm \ |
| -m 1024 -bios boot_rom.bin -boot menu=on \ |
| -nodefaults -device VGA -device pci-ohci -device usb-kbd \ |
| -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \ |
| -tpmdev emulator,id=tpm0,chardev=chrtpm \ |
| -device tpm-spapr,tpmdev=tpm0 \ |
| -device spapr-vscsi,id=scsi0,reg=0x00002000 \ |
| -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0 \ |
| -drive file=test.img,format=raw,if=none,id=drive-virtio-disk0 |
| |
| Notes: |
| - The Linux kernel in the VM must have the tpm_ibmvtpm module available |
| or built-in. A recent kernel is needed that enables TPM 2.0 support |
| in this module. |
| |
| - 'swtpm_ioctl --unix /tmp/mytpm1/swtpm-sock -s' can be used to gracefully |
| shut down the vTPM. |
