amsphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget//translations/zh_CN/security/tpm/tpm_vtpm_proxymodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/zh_TW/security/tpm/tpm_vtpm_proxymodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/it_IT/security/tpm/tpm_vtpm_proxymodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/ja_JP/security/tpm/tpm_vtpm_proxymodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/ko_KR/security/tpm/tpm_vtpm_proxymodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/sp_SP/security/tpm/tpm_vtpm_proxymodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhsection)}(hhh](htitle)}(h-Virtual TPM Proxy Driver for Linux Containersh]h-Virtual TPM Proxy Driver for Linux Containers}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhI/var/lib/git/docbuild/linux/Documentation/security/tpm/tpm_vtpm_proxy.rsthKubh line_block)}(hhh](hh)}(hAuthors:h]hAuthors:}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hindentKhhhhhhhKubh)}(h*Stefan Berger h](hStefan Berger <}(hhhhhNhNubh reference)}(hstefanb@linux.vnet.ibm.comh]hstefanb@linux.vnet.ibm.com}(hhhhhNhNubah}(h]h ]h"]h$]h&]refuri!mailto:stefanb@linux.vnet.ibm.comuh1hhhubh>}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhKhhhhhhhKubeh}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh paragraph)}(hlThis document describes the virtual Trusted Platform Module (vTPM) proxy device driver for Linux containers.h]hlThis document describes the virtual Trusted Platform Module (vTPM) proxy device driver for Linux containers.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(h Introductionh]h Introduction}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK ubh)}(hXThe goal of this work is to provide TPM functionality to each Linux container. This allows programs to interact with a TPM in a container the same way they interact with a TPM on the physical system. Each container gets its own unique, emulated, software TPM.h]hXThe goal of this work is to provide TPM functionality to each Linux container. This allows programs to interact with a TPM in a container the same way they interact with a TPM on the physical system. Each container gets its own unique, emulated, software TPM.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h] introductionah ]h"] introductionah$]h&]uh1hhhhhhhhK ubh)}(hhh](h)}(hDesignh]hDesign}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj-hhhhhKubh)}(hXUTo make an emulated software TPM available to each container, the container management stack needs to create a device pair consisting of a client TPM character device ``/dev/tpmX`` (with X=0,1,2...) and a 'server side' file descriptor. The former is moved into the container by creating a character device with the appropriate major and minor numbers while the file descriptor is passed to the TPM emulator. Software inside the container can then send TPM commands using the character device and the emulator will receive the commands via the file descriptor and use it for sending back responses.h](hTo make an emulated software TPM available to each container, the container management stack needs to create a device pair consisting of a client TPM character device }(hj>hhhNhNubhliteral)}(h ``/dev/tpmX``h]h /dev/tpmX}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1jFhj>ubhX (with X=0,1,2...) and a ‘server side’ file descriptor. The former is moved into the container by creating a character device with the appropriate major and minor numbers while the file descriptor is passed to the TPM emulator. Software inside the container can then send TPM commands using the character device and the emulator will receive the commands via the file descriptor and use it for sending back responses.}(hj>hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj-hhubh)}(hXUTo support this, the virtual TPM proxy driver provides a device ``/dev/vtpmx`` that is used to create device pairs using an ioctl. The ioctl takes as an input flags for configuring the device. The flags for example indicate whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator. The result of the ioctl are the file descriptor for the 'server side' as well as the major and minor numbers of the character device that was created. Besides that the number of the TPM character device is returned. If for example ``/dev/tpm10`` was created, the number (``dev_num``) 10 is returned.h](h@To support this, the virtual TPM proxy driver provides a device }(hj`hhhNhNubjG)}(h``/dev/vtpmx``h]h /dev/vtpmx}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1jFhj`ubhX that is used to create device pairs using an ioctl. The ioctl takes as an input flags for configuring the device. The flags for example indicate whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator. The result of the ioctl are the file descriptor for the ‘server side’ as well as the major and minor numbers of the character device that was created. Besides that the number of the TPM character device is returned. If for example }(hj`hhhNhNubjG)}(h``/dev/tpm10``h]h /dev/tpm10}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1jFhj`ubh was created, the number (}(hj`hhhNhNubjG)}(h ``dev_num``h]hdev_num}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jFhj`ubh) 10 is returned.}(hj`hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj-hhubh)}(hOnce the device has been created, the driver will immediately try to talk to the TPM. All commands from the driver can be read from the file descriptor returned by the ioctl. The commands should be responded to immediately.h]hOnce the device has been created, the driver will immediately try to talk to the TPM. All commands from the driver can be read from the file descriptor returned by the ioctl. The commands should be responded to immediately.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK(hj-hhubeh}(h]designah ]h"]designah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hUAPIh]hUAPI}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK-ubhindex)}(hhh]h}(h]h ]h"]h$]h&]entries](singlevtpm_proxy_flags (C enum)c.vtpm_proxy_flagshNtauh1jhjhhhNhNubhdesc)}(hhh](hdesc_signature)}(hvtpm_proxy_flagsh]hdesc_signature_line)}(henum vtpm_proxy_flagsh](hdesc_sig_keyword)}(henumh]henum}(hjhhhNhNubah}(h]h ]kah"]h$]h&]uh1jhjhhhk/var/lib/git/docbuild/linux/Documentation/security/tpm/tpm_vtpm_proxy:47: ./include/uapi/linux/vtpm_proxy.hhKubhdesc_sig_space)}(h h]h }(hjhhhNhNubah}(h]h ]wah"]h$]h&]uh1jhjhhhjhKubh desc_name)}(hvtpm_proxy_flagsh]h desc_sig_name)}(hjh]hvtpm_proxy_flags}(hjhhhNhNubah}(h]h ]nah"]h$]h&]uh1jhjubah}(h]h ](sig-namedescnameeh"]h$]h&] xml:spacepreserveuh1jhjhhhjhKubeh}(h]h ]h"]h$]h&]j.j/ add_permalinkuh1jsphinx_line_type declaratorhjhhhjhKubah}(h]jah ](sig sig-objecteh"]h$]h&] is_multiline _toc_parts) _toc_namehuh1jhjhKhjhhubh desc_content)}(hhh]h)}(hflags for the proxy TPMh]hflags for the proxy TPM}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1hhk/var/lib/git/docbuild/linux/Documentation/security/tpm/tpm_vtpm_proxy:47: ./include/uapi/linux/vtpm_proxy.hhKhjFhhubah}(h]h ]h"]h$]h&]uh1jDhjhhhjhKubeh}(h]h ](cenumeh"]h$]h&]domainjaobjtypejbdesctypejbnoindex noindexentrynocontentsentryuh1jhhhjhNhNubh container)}(hM**Constants** ``VTPM_PROXY_FLAG_TPM2`` the proxy TPM uses TPM 2.0 protocolh](h)}(h **Constants**h]hstrong)}(hjth]h Constants}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1jvhjrubah}(h]h ]h"]h$]h&]uh1hhk/var/lib/git/docbuild/linux/Documentation/security/tpm/tpm_vtpm_proxy:47: ./include/uapi/linux/vtpm_proxy.hhKhjnubhdefinition_list)}(hhh]hdefinition_list_item)}(h<``VTPM_PROXY_FLAG_TPM2`` the proxy TPM uses TPM 2.0 protocolh](hterm)}(h``VTPM_PROXY_FLAG_TPM2``h]jG)}(hjh]hVTPM_PROXY_FLAG_TPM2}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jFhjubah}(h]h ]h"]h$]h&]uh1jhk/var/lib/git/docbuild/linux/Documentation/security/tpm/tpm_vtpm_proxy:47: ./include/uapi/linux/vtpm_proxy.hhKhjubh definition)}(hhh]h)}(h#the proxy TPM uses TPM 2.0 protocolh]h#the proxy TPM uses TPM 2.0 protocol}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhk/var/lib/git/docbuild/linux/Documentation/security/tpm/tpm_vtpm_proxy:47: ./include/uapi/linux/vtpm_proxy.hhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1jhjnubeh}(h]h ] kernelindentah"]h$]h&]uh1jlhjhhhNhNubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jvtpm_proxy_new_dev (C struct)c.vtpm_proxy_new_devhNtauh1jhjhhhNhNubj)}(hhh](j)}(hvtpm_proxy_new_devh]j)}(hstruct vtpm_proxy_new_devh](j)}(hstructh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhk/var/lib/git/docbuild/linux/Documentation/security/tpm/tpm_vtpm_proxy:47: ./include/uapi/linux/vtpm_proxy.hhK%ubj)}(h h]h }(hjhhhNhNubah}(h]h ]j ah"]h$]h&]uh1jhjhhhjhK%ubj)}(hvtpm_proxy_new_devh]j)}(hjh]hvtpm_proxy_new_dev}(hjhhhNhNubah}(h]h ]j"ah"]h$]h&]uh1jhjubah}(h]h ](j)j*eh"]h$]h&]j.j/uh1jhjhhhjhK%ubeh}(h]h ]h"]h$]h&]j.j/j6uh1jj7j8hjhhhjhK%ubah}(h]jah ](j<j=eh"]h$]h&]jAjB)jChuh1jhjhK%hjhhubjE)}(hhh]h)}(h