Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754757AbcCJRib (ORCPT ); Thu, 10 Mar 2016 12:38:31 -0500 Received: from e35.co.us.ibm.com ([32.97.110.153]:51354 "EHLO e35.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752741AbcCJRiY (ORCPT ); Thu, 10 Mar 2016 12:38:24 -0500 X-IBM-Helo: d03dlp03.boulder.ibm.com X-IBM-MailFrom: stefanb@linux.vnet.ibm.com X-IBM-RcptTo: linux-api@vger.kernel.org;linux-doc@vger.kernel.org;linux-kernel@vger.kernel.org Subject: Re: [PATCH v6 08/11] tpm: Driver for supporting multiple emulated TPMs To: Andy Lutomirski References: <1457545170-30120-1-git-send-email-stefanb@linux.vnet.ibm.com> <1457545170-30120-9-git-send-email-stefanb@linux.vnet.ibm.com> <56E0DD47.50208@linux.vnet.ibm.com> Cc: Jarkko Sakkinen , Jason Gunthorpe , "linux-kernel@vger.kernel.org" , "linux-doc@vger.kernel.org" , Linux API From: Stefan Berger Message-ID: <56E1B10A.1030008@linux.vnet.ibm.com> Date: Thu, 10 Mar 2016 12:38:18 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16031017-0013-0000-0000-00001DDD024A Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2138 Lines: 44 On 03/09/2016 09:57 PM, Andy Lutomirski wrote: > On Wed, Mar 9, 2016 at 6:34 PM, Stefan Berger > wrote: >> On 03/09/2016 01:01 PM, Andy Lutomirski wrote: >>> On Wed, Mar 9, 2016 at 9:39 AM, Stefan Berger >>> wrote: >>>> This patch implements a driver for supporting multiple emulated TPMs in a >>>> system. >>>> >>>> The driver implements a device /dev/vtpmx that is used to created >>>> a client device pair /dev/tpmX (e.g., /dev/tpm10) and a server side that >>>> is accessed using a file descriptor returned by an ioctl. >>>> The device /dev/tpmX is the usual TPM device created by the core TPM >>>> driver. Applications or kernel subsystems can send TPM commands to it >>>> and the corresponding server-side file descriptor receives these >>>> commands and delivers them to an emulated TPM. >>> Nifty! >>> >>> Is anyone considering writing a modification or replacement of >>> trousers that creates claims the real tpm and exposes a vtpm that >>> handles multiplexing internally? Does the vtpm driver intelligently >>> support multiple simultaneous clients? >> >> The vtpm driver allows to use an independent trousers instance in each >> container. >> >> Using the VTPM_NEW_DEV ioctl the container mgmt. stack can create a >> /dev/tpmX (X=0,1,2,...) device and a file descriptor. The file descriptor is >> passed to a vTPM instance, the /dev/tpmX is moved into the container, >> meaning a device with the same major/minor numbers is created in the >> container. This then allows each container to talk to an independent vTPM. >> The vTPM can either be 1.2 or 2. > What I meant was: > > If two clients connect to the same vTPM slave node, can the master > program tell requests from the two clients apart? If so, great! If > not, then I'd consider that to be somewhat sad. vTPM slave node being /dev/tpmX? TPM types of devices can currently only be opened by one application. This can for example be TSS/trousers, which then offers an API to applications for sending TPM commands. That only one application is allowed is a limitation of the existing driver. Stefan