Update the description in the man page to reflect ioctl's and
control channel commands.
Update to the latest supported commands.
Fix a few text locations on the way.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Change the startup behavior with respect to requiring an INIT command
via control channel. We change this for the socket and chardev
interfaces so that the behavior now is the same as that of the CUSE
interface.
Introduce the --flag not-need-init command line option for the socket
and chardev interfaces to allow the old behavior using this option.
Adapt some of the test cases and swtpm_setup.sh.in that now need this
command line flag.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Allow running swtpm_setup directly as tss user using the following
command lines as an example for how to do it:
mkdir /tmp/test-tss
chown tss:tss /tmp/test-tss
chmod 770 /tmp/test-tss
su -c "swtpm_setup --tpm-state /tmp/test-tss" -s /bin/sh tss
This change prevents us from requiring invocation under the root
user.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement support for --locality allow-set-locality option that
is primarily useful in cases when the VTPM proxy access is enabled
by file descriptor passing.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add options for locality handling so that commands in locality
4 for example are rejected per command line parameter. This is
useful when the vTPM is used with containers.
Also implement the custom TPM/TPM2_SetLocality command to allow
the Linux vTPM proxy driver to set the locality in which subsequent
TPM commands will be executed.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
New option '--ctrl clientfd=<fd>' is added to the control socket parameters.
The passed 'fd' is used as control channel client-fd and treated as single
client mode.
Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com>
Expose the logging level to the command line by extending the
log option with a level parameter.
Extend the man swtpm man page with the level parameter.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement the option --vtpm-proxy that create a Linux vtpm proxy device
and makes the chardev TPM listen on the anaonymous file descriptor that
is returned from the ioctl creating the device.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Support --tpm-state option as an alias for the --tpmstate option.
--tpm-state is a parameter that is also supported by the swtpm
program, so for consistency reasons we should have the same name
for the option here.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add support for UnixIO and TCP control channels. Both types of
transport require that packets are sent in big endian format
and therefore some code needs to be adjusted for that. The
ioctl interface is local and in that case no endianess conversion
is done.
Add a new test case that uses the extended swtpm_ioctl tool to
test the control channel.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add support for --connect option for the socket version of the TPM.
This parameter takes the type, port, file descriptor and disconnect
options. Only TCP connections are currently supported.
See updated man pages.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Move the code to change process ownership into its own function and enable
--runas|-r <owner> in all implementations.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Extend the swtpm_bios tool with an option to give up physical presence.
Have the TPM error codes reflected in the exit error of 128.
Add a test case for the tool.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement a control channel for the 'chardev' swtpm that implements
a minimal set of control messages for now.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add support for 'swtpm chardev' that listens for TPM commands on a given
character device and sends responses through it.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add support for the --tpmstate dir=<dir> command line parameter.
It will be used instead of the TPM_PATH, unless it is not set.
Adapt two test cases for the new parameter.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add support for --pid file=<pidfile> command line parameter support.
The swtpm_cuse and swtpm now write their process IDs (pids) into
a file.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Support the read/write interface and POSIX API calls for transfer of
TPM state blobs.
Extend the swtpm_ioctl program to support this as well. Use the
environment variable SWTPM_IOCTL_BUFFERSIZE to set the size of the
buffer to use and enable the read/write interface in this (test)
program.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add an ioctl that lets an application retrieve which keys are in use by the
TPM, i.e., file encryption or migration key
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
The migration key ensures that TPM state blobs, when retrieved using the
ioctl for getting state blobs, are always encrypted with this key.
When the state is later on loaded back into the TPM using the ioctl
to set the state blobs, the migration key is used to decrypt them.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
