Chinaunix首页 | 论坛 | 博客
  • 博客访问: 207950
  • 博文数量: 10
  • 博客积分: 2010
  • 博客等级: 大尉
  • 技术积分: 550
  • 用 户 组: 普通用户
  • 注册时间: 2007-01-13 21:23
文章分类
文章存档

2011年(1)

2010年(5)

2009年(4)

我的朋友

分类: LINUX

2010-07-05 14:04:36

 
hi,我又来了,今天直接进入正题——vTPM,这也是我主要分析的模块之一,这个系列文章我会通过分析xen源码实现学习介绍Xen的原理机制,分析的对象主要就是xen安全相关功能,比如说vTPM,它本身很好地体现了分离驱动的机制,并且为下一个分析对象——MiniOS作准备,不了解?看看Mini-OS 介绍吧。
QQ :   61304046
gmail: benbenhappy2008
我的百度空间:http://hi.baidu.com/from2_6_30_1/blog
转载请注明出处哦:)

虚拟TPM的实现有几个不同的架构模型[1],xen中实现的是IBM[2]和Intel[3]提出的,并分别完成了分离驱动模型中的vTPM前后端驱动,但与IBM论文中不同的是,在XEN中并没有物理TPM到vTPM的PCR映射,也就是说PCR0~8并不完全一样。主要问题是对于如何解决Quote时的签名问题存在分歧,vTPM会对整个quote签名但对于它如何使用映射过来的PCR是个问题,TPM设计之初只考虑了单一系统环境。还有就是在HVM中VM拥有自己的BIOS/bootloader,如何确定执行扩展操作时使用哪个度量值到哪个PCR中?另一不同之处是vTPM迁移协议,但目前XEN中的实现的vTPM似乎没有用到(哪位有研究不妨给我讲解一下)。

在XEN中,vTPM是由一个或多个vTPM实例,vTPM管理工具和Hot-plug脚本组成。vTPM实例其实就是一个VM中的TPM,每个需要TPM功能的VM在整个生命期内都与一个唯一的vTPM实例关联,也就是一一对应。在XEN中使用的是Mario Strasser开发的tpm-emulator[4]。
Overview of the TPM emulator package
图1: TPM emulator架构

tpm emulator作为一个vTPM实例使用就无须TPM设备驱动以及内核模块的支持,但为了能够与tpmd通讯需要修改命名管道。
先看一下/usr/src/xen-unstable/tools/vtpm/代码中的readme介绍:
 vtpmd Flow (for vtpm_manager. vtpmd never run by default)
============================
- Launch the VTPM manager (vtpm_managerd) which which begins listening to the BE with one thread
and listens to a named fifo that is shared by the vtpms to commuincate with the manager.
- VTPM Manager listens to TPM BE.
- When xend launches a tpm frontend equipped VM it contacts the manager over the vtpm backend.
- When the manager receives the open message from the BE, it launches a vtpm
- Xend allows the VM to continue booting.
- When a TPM request is issued to the front end, the front end transmits the TPM request to the backend.
- The manager receives the TPM requests and uses a named fifo to forward the request to the vtpm.
- The fifo listener begins listening for the reply from vtpm for the request.
- Vtpm processes request and replies to manager over shared named fifo.
- If needed, the vtpm may send a request to the vtpm_manager at any time to save it's secrets to disk.
- Manager receives response from vtpm and passes it back to backend for forwarding to guest.
另外根据该目录下的Makefile和Rules.mk似乎指定了tpm emulator版本:
 TPM_EMULATOR_NAME = tpm_emulator-0.5.1
这个有点僵,我查了一下该软件的官网上已经有更新,不过没关系我们编译时可以选择编译自己下载的:
# cd /usr/src
# svn checkout tpm-emulator
# cd /usr/src/tpm-emulator
# make
# make install

然后修改/usr/src/xen-unstable/Config.mk为
VTPM_TOOLS ?= y
不过要把/usr/src/xen-unstable/tools/vtpm/Rules.mk修改为
BUILD_EMULATOR = n
记得要安装gmp库哦:)

该目录下剩余几个都是patch文件,没什么好看的,先放过。跳到/usr/src/xen-unstable/tools/vtpm_manager/
readme告诉我们该目录结构以及基本流程:
Single-VM Flow
============================
- Launch the VTPM manager (vtpm_managerd) which which begins listening to the BE with one thread
and listens to a named fifo that is shared by the vtpms to commuincate with the manager.
- VTPM Manager listens to TPM BE.
- When xend launches a tpm frontend equipped VM it contacts the manager over the vtpm backend.
- When the manager receives the open message from the BE, it launches a vtpm
- Xend allows the VM to continue booting.
- When a TPM request is issued to the front end, the front end transmits the TPM request to the backend.
- The manager receives the TPM requests and uses a named fifo to forward the request to the vtpm.
- The fifo listener begins listening for the reply from vtpm for the request.
- Vtpm processes request and replies to manager over shared named fifo.
- If needed, the vtpm may send a request to the vtpm_manager at any time to save it's secrets to disk.
- Manager receives response from vtpm and passes it back to backend for forwarding to guest.

我们看看manager目录下的代码:
首先Makefile告诉我们将生成一个
BIN = vtpm_managerd
也就是vTPM管理工具守护进程,接着看我们的vtpmd.c
   // -------------------- Initialize Manager ----------------- 
if (() != ) {
(, "Closing vtpmd due to error during startup.\n");
return -1;
}
Initialize Manager斗大的字,干什么用的一目了然,注意里面调用的点一下跟进去看看:
Defined as a function in:
看看它究竟干了些什么:
   // Create new TCS Object
// Create TCS Context for service
// Create OIAP session for service's authorized commands
// If fails, create new Manager.
serviceStatus = ();
//Load Storage Key
// Create entry for Dom0 for control messages
呵呵,偷了些懒,不过这些信息足够了,这个初始化管理程序创建新的TCS对象和上下文环境以及OIAP对话,
调用 ()似乎是加载vTPM管理数据。
OK,我们回到vtpmd.c
// ------------------- Set up file ipc structures ----------
调用函数vtpm_ipc_init()初始化FIFO文件
// -------------------- Set up thread params -------------
设置线程参数
// --------------------- Launch Threads -----------------
下面启动了be_thread、dmi_thread、hp_thread三个线程监听来之后端驱动、vTPM实例和热插件的命令和数据,
其中的vtpm_manager_thread()会调用命令处理函数VTPM_Manager_Handler()处理命令请求:
void *(void *arg_void) {
* = ( *) (sizeof() );
struct * = (struct *) arg_void;

* = (->, ->,
->fw_tpm, ->fw_tx_ipc_h, ->fw_rx_ipc_h,
->is_priv, ->thread_name);

return ();
}


继续跟下去
( *,
*,
fw_tpm, // Forward TPM cmds?
*fw_tx_ipc_h,
*fw_rx_ipc_h,
is_priv,
char *thread_name) {

// ------------------------ Main Loop --------------------------------
while(1) {

(, "%s waiting for messages.\n", thread_name);

// --------------------- Read Cmd from Sender ----------------

// Read command header
size_read = (, , cmd_header, );

size_write = (, (dmi_res ? dmi_res->tx_vtpm_ipc_h : ), reply, reply_size );
可以看到在函数主循环中调用 接收并解析命令消息,调用 返回结果。
好了今天就到这里吧,下次结合起来分析前后端驱动的问题。
我的百度空间:http://hi.baidu.com/from2_6_30_1/blog
注: vTPM实例守护进程叫vtpmd,这个守护进程不是由用户启动的而是由vTPM管理工具启动。

[1] about vTPM
[2] vTPM: Virtualizing the Trusted Platform Module
[3]
[4]

阅读(13197) | 评论(0) | 转发(0) |
给主人留下些什么吧!~~